Debian package with configurable authentication proxy that checks incoming OAuth2 JWT access tokens. If successfully checked for validity and if the access token contains the necessary roles it will put a fixed X509 client certificate onto the calls to the backend.