I know this is how discourse handles federated identity: it uses the Oauth2 server to match the account's email address against the Facebook/Google/Twitter account's stored email address. Spotify works this way too.