Comment by elevation

It _has_ an IdP, but you have to be authenticated at a lower layer in the stack before you can talk to it.

Think Tailscale+Let's Encrypt+Okta but all in a single package.