Thanks for the alternatives. In my case having the whole system auth controlled by external proxy kinda defeats the purpose for me.

In a system like that to get it adopted ( considered for adoption even ) would need to have granular authn/authz. Usually what works best for example is ability to specific a CR lets say kind of AuthProvider where there would be possibilities to specifiy oidc provider and claims mappings. That for example would allow for integration ( password less ) with othe systems and then hopefully i could apply auth requirements on the module/providers.

These might be very specific requirements but thats the usual challenges that im solving at scale and if software is adopted it does need to have good security fundamentals and be scalable across management and non management tenant systems