We have an MVC app using simple authentication via username/ password and comparing the hashed password against our database to authenticate the user. What steps would we need to take to move into an SSO direction?

My initial thought is we'd keep the current users and keep that option to login that way. We'd need to modify our user table to include a column denoting that the account is "federated", in that the credentials are stored somewhere else.

Then we'd create an authorization service (SAML/ OAuth2 presumably) that will be called when a user logs in with a trusted provider identity, say LinkedIn, and pass this request to the Secure Token System which will verify with LinkedIn, and send us back a token authenticating the user. From there we decide if we want to authorize them to any services?