I am building a simple website that basically hosts a bunch of PDFs behind a PDF Viewer app. I will link to these PDFs from an external site, but I need a way of keeping these from being openly accessible. There is also a interactive map viewer component that is hosted on the server (ESRI Web Appbuilder). This already has its own security mechanism.
I am looking for a solution that allows me to basically lock an entire webserver (Apache in this case, but open to other suggestions), behind a login screen. Ideally it would support either Active Directory and/or OAuth.
I am aware of Apache basic auth, but as I understand it, this would check credentials on every page load, which might not make our IT people very happy and also would probably slow things down somewhat.