You can use the great oauth2-proxy as a forward auth proxy to archive that if you use nginx btw, i did that before envoy.