For long-term modernization, which approaches do you prefer for replacing Legacy LDAP-dependent auth apps (reverse-proxy SSO, OAuth/OIDC adapter, etc.), and what are typical pitfalls? For orgs with a vast on-prem presence with core applications that are mission critical.