Minimal authentication workflow

[pomber]

Thanks! should I put any scopes or claims? or leave them empty if I only care about the username?