Aaron Parecki

Azure static web apps has auth proxy built in and is pretty lightweight, $9 to byo oidc. Or an az function proxy and use easyauth/write a couple of methods to handle the redirect and code redemption. That's free under 1m executions

In that case you could move the whole static site to a specific directory that is protected via a _redirects definition ? Access is only granted to a specific role. https://docs.netlify.com/visitor-access/role-based-access-control/ Roles can be set via Identity

yeah, that definitely works! here’s some code to change roles if you need to, but in general Netlify Identity / roles will definitely let you gate content

https://github.com/stripe-samples/netlify-stripe-subscriptions

I used https://github.com/oauth2-proxy/oauth2-proxy in front of S3 years ago, worked quite well.

can you say more about what the ideal workflow is? if you can set a cookie, you can allow/deny access based on cookie presence https://docs.netlify.com/routing/redirects/redirect-options/#redirect-by-cookie-presence

Have you tried Snippet Injection? https://docs.netlify.com/site-deploys/post-processing/snippet-injection/ You could inject the Identity code in your static code https://identity.netlify.com/

can you say more about what the ideal workflow is? if you can set a cookie, you can allow/deny access based on cookie presence https://docs.netlify.com/routing/redirects/redirect-options/#redirect-by-cookie-presence

mod_auth_openidc for Apache or nginx equivalent by the excellent @hanszandbelt?

If you can't modify it, how do you have access to deploy it somewhere else?

Netlify @cassidoo @jlengstorf can help

Google, Azure, AWS all have the concept of the identity aware proxy, which is something that inspects the jwt/token and denies access if it's not valid. I've used GCP's, and it's pretty well featured, but the other providers should be reasonable as well (it's a common feature)