Aaron Parecki

I used https://github.com/oauth2-proxy/oauth2-proxy in front of S3 years ago, worked quite well.

can you say more about what the ideal workflow is? if you can set a cookie, you can allow/deny access based on cookie presence https://docs.netlify.com/routing/redirects/redirect-options/#redirect-by-cookie-presence

Have you tried Snippet Injection? https://docs.netlify.com/site-deploys/post-processing/snippet-injection/ You could inject the Identity code in your static code https://identity.netlify.com/

can you say more about what the ideal workflow is? if you can set a cookie, you can allow/deny access based on cookie presence https://docs.netlify.com/routing/redirects/redirect-options/#redirect-by-cookie-presence

mod_auth_openidc for Apache or nginx equivalent by the excellent @hanszandbelt?

If you can't modify it, how do you have access to deploy it somewhere else?

Netlify @cassidoo @jlengstorf can help

Google, Azure, AWS all have the concept of the identity aware proxy, which is something that inspects the jwt/token and denies access if it's not valid. I've used GCP's, and it's pretty well featured, but the other providers should be reasonable as well (it's a common feature)