How do I put SSO in front of an app with no login?

Place a reverse proxy in front of the application and delegate access decisions to an authentication service. ForwardAuth allows a request through after a successful 2xx authorization response.

Before rollout, test anonymous denial, authorized access and session expiry. Prevent direct access to the origin, otherwise requests can bypass the gate.