Comment by unethical_ban

You can do that in principle. Most non enterprise tools don't support it because they don't merely want an IdP, they want an IdP doing anti-spam and reputation and outsourcing of account recovery and throttling of bulk user creation.

If anyone could attest to who they are at any time we could just have user/pass without email and call it a day.