What is an authentication proxy?

An authentication proxy connects two protocol segments and thereby forms a protocol endpoint; it can transform and forward authentication requests and responses, and can be part of an intermediary.

Because it terminates the protocol on both sides it sees the content of what it forwards, which is why end-to-end encryption across a broker is hard.