In the IdP/SP/SAML sense of it, I'm really used to that level of validation actually hitting the application and being processed through an authentication subsystem, rather than being done at the webserver level.

Possibly just some nginx features I'm not familiar with, or are there whole apps out there that serve to be nothing other than an authentication layer inside of a webserver? Are they popular?

Sorry if I misunderstood the question, sounds like you are asking if there are some common tools that do auth outside of the application before passing traffic back.

Google IAP is a big one, and Cloudflare Access can let you do similar things (link an internal service to Cloudflare network and Cloudflare will deny someone ability to talk to that service until they've validated their identity to cloudflare and it matches your rules somehow.

Azure AD Application Proxy fits the bill for Microsoft 365 shops.

Nothing from Atlassian should ever be exposed to the public internet. Atlassian stuff is a security tire-fire with very old dependencies even in the latest releases, a painful reinstall/config merge needed for even minor patches, and no auto-update mechanism.

You absolutely do, but I was more interested in the mechanics of it at the webserver level rather than SaaS equivalents. The Google IAP one is helpful as I only knew about Cloudflare Access.

HTTP Redirecting out to an idp and it posting back to the application with a SAML assertion is pretty common, if that's what you mean. Lots of people do that with things like O365, the AWS Web Console, etc.

Of course. Just asking how is the web router aware of whether or not the redirect is necessary if you're not hitting the application to validate login state.