There are lots of ways around doing a full SSO integration, though.
In the simplest form, the ISP could simply use a captive portal of some sort directing the user to authenticate first.
While captive portals can’t serve the correct certificate most browsers these days are smart enough to detect a captive portal redirect and give the user a smoother experience.
@PriorProject @PorkrollPosadist
All the examples you provided were infrastructure, not social communities, so I think it’s a poor comparison.
Instead, I’d compare AP federation to _social_ constructs. Communities, clubs, groups of friends. Even larger constructs like cities or nation states.
In _those_ examples it’s clear that limiting association is commonplace and healthy.