Chaining with other OIDC or SAML solutions (or custom)

Question

Hi,

We are a SaaS product offering authentication services via OIDC but we want to do this as second factor in a composed flow after using Azure AD authentication.

Only options that we have seen are to completely delegate authentication but not to do both, ie first login with Azure AD IdP, then be redirected to our IdP and the return back to Azure AD which will issue the token. This kind of flows are very typical in other products like WSO2 or Keycloak.

Other option will be to develop a plugin like is possible for example with Keycloak https://www.keycloak.org/extensions.html but we either have found documentation.

Any options regarding customization of authentication mechanisms will be very much appreciated.

Thank you very much in advance,