Question to all - are there any docs on the suggested best practise for authentication with the open source / self hosted prefect server?

Mostly I've seen proxies and using AD of some sort to only allow certain users to log into the WebUI.