I am building spring based system where in the requirement is that the users of group A are kept in one set of machines and users of group B are in another set of machines. The servers for group A will hold data for only those groups users and same for the other group. I currently envision a authentication/redirector service (login service) which will redirect users to the correct servers. So the users could all come to login.example.com and be redirected to a.example.com and b.example.com 

The thing is that it should be possible to seamlessly migrate a user from group A to group B and if a user wants to belong to group A and B it must be somehow possible.

I have been looking out for OAuth and some "hackey" ways of doing it but would like to know how this problem is handled by others.