This is not a complete solution but it may possibly work. But, before that some context on cardano addresses and the delegation process is required:
Cardano addresses are of different types as described on the Cardano Ledger Spec :
Base addresses, Addr
base, containing the hash of a payment credential and the hash of a staking credential. Note that the payment
credential hash is the hash of the key (or script)which has contol of
the funds at this address, i.e. is able to witness spending them. The
staking credential controls the delegation decision for the Ada at
this address (i.e. it is used for rewards, staking, etc.). The staking
credential must be a (registered) delegation credential.
Pointer addresses, Addr
ptr , containing the hash of a payment credential and a pointer to a stake credential registration
When a user delegates to a stake pool, a delegation certificate is posted to the blockchain. It contains:
- The stake key registration certificate hash
- The stake pool id (hash) the use has delegated to.
Assuming a base address is used in the delegation transaction, this means that the address is linked to the stake key hash contained in the certificate.
So a potential login solution would be have the user generate a pointer address in his wallet and paste it in a field on you webapp login page.
On the back-end, you could fetch the original delegation address and the stake key linked to it.Then check if the pointer address submitted is linked to the same stake key as the original address.
If there is a match it can only mean that the private key used to derive the original address is the same private key used to derive the pointer address, therefore the user submitting the pointer address must be the same user who delegated to you pool.
Some useful references related to this: