For SSO the idea we have is to configure it at the LB ("Authenticate" in the LB rule for an OIDC source which would be Azure AD) and then Gitea would have to lo

For SSO the idea we have is to configure it at the LB ("Authenticate" in the LB rule for an OIDC source which would be Azure AD) and then Gitea would have to look at the JWT in the header to get from there the authenticated user email. So Azure AD and the AWS LB handle authentication whilst Gitea only handles authorization.