Authentication & Authorization using Ingress-nginx

We have services deployed in K8s with istio as service mesh and exposed using Ingress-nginx.

Now, we would like to add AuthN and AuthZ using Ingress-nginx ingress controller.

1. We would like do Oauth2-OpenID. That is passible using oauth2-proxy
   module. The jwt token returned is having UUID of user, but not his
   group.
2. We have k8s service which has mapping of user UUID and group
   (Backend dynamodb). So we need to retrieve group of user.
3. We have OPA (open policy agent) based rules for AuthZ of service APIs against usergroup. So service APIs have to be verified against usergroup.
4. Once after successful AuthN and AuthZ, http headers
   with user UUID, userGroup should be passed to upstream services.
5. Also we need to set cookies with user UUID, userGroup for client apps to use it.

All these above 5 steps can be performed in bit and pieces using ‘Ingress-nginx’. But, not together as chain of proxies.
Is there a way to do these in ‘Ingress-nginx’ ingress controller? I am looking for Opensource ingress controllers.

Thanks.

Regards,
Prakash