A3M - Account Authentication & Authorization Module

[eluser]gr0uch0mars[/eluser]
Here I'm again. I've written a draft of situations. Of course there are flaws, but take a look, I'm trying to cover every situation.
*IDP = ID Provider (email account provider like Gmail, Yahoo, AOL...) I define it as "Trust" when we can communicate with it, and "Untrusted" when it a mere email service (small company email account)

NO EMAIL (people without an email account: children, old people or people who don't want to share it)

1) Registration: Username + Password
2) Login: Username + Password
3) Recovery:
a) Username: NO WAY!!!
b) Password: Username + Secret Question

EMAIL

1) Registration:
Email:
- IDP* Trusted: Retrieve Username (ask for one if blank) + Ask for Password (for log in without email)
- IDP* Not Trusted: Ask for Username + Ask for Password
Username: the same as user without email

2) Login:
Email:
- IDP* Trusted: connect to IDP and, if successfull, log in.
- IDP* Not Trusted: + Password
Username: Username + Password

3) Recovery:
Email:
- IDP recovery process.
- Login via Username + Password
Username:
- Login via Email
Password:
- Login via Email from Trusted IDP (not requires our stored password)
- Login via Email from Untrusted IDP + Secret Question/Send new password by email
- Username + Secret Question


Please, any doubt about my scheme, ask it.
Then, discuss.