>which organically does not support password-based auth

This is the way. Everything else is just gravy imo.