Adding SSO after many users already signed up -- how to migrate them?

I would just use the existing admin/users/list/active.json and extend the response with the hashed passwords.

Also, stick to the existing API authentication mechanism, don’t reinvent another wheel.