Protect this OAuth2 server with Shibboleth (ie Australian Access Federation) and use client apps to authorize against it