25-May-2022 23:11
27-May-2022 00:45
Well sort of, thats a good place to start. but it doesn't mention that the 401 header needs to have
WWW-Authenticate: bearer
if it doesn't then the f5 ignores the 401 and send it through to the original client - but not the oauth client as its the F5.