Using ACS as a oAuth2 passive authentication point

I'm looking for a solution to use our existing ACS infrastructure (many different Identity services brokered via ACS) and expose it to some clients who want passive authentication and authorisation with oAuth2.

Our existing clients use a passive WS-Fed flow and this works ok.

There is a oAuth2 endpoint listed in ACS, can that be used for a passive authentication flow?

Failing this, WAAD seems to have a oAuth2 endpoint. Could our ACS be added to a WAAD instance and hence be used as oAuth2?

Thanks for any help.

Chris