I can't speak for Google, but I'm working on something similar as a personal project and here is my architecture;
Each service has its own store of objects. Each store also has a directory of Metadata describing the objects contained in each service.
When you send an Auth request to a service; the service you are sending the request to looks up which service is the authority for the given object and then routes the request to that service for auth.
You can do away with the Metadata store if you offload responsibility for remembering which store to use to the user. You provide them with a cookie that tells any of your Auth servers which store contains this users data.
Each service has its own store of objects. Each store also has a directory of Metadata describing the objects contained in each service.
When you send an Auth request to a service; the service you are sending the request to looks up which service is the authority for the given object and then routes the request to that service for auth.
You can do away with the Metadata store if you offload responsibility for remembering which store to use to the user. You provide them with a cookie that tells any of your Auth servers which store contains this users data.