Friday I met with Craig Counterman to discuss web authentication.
Notable points of the conversation include:

• Stellar now uses Apache 2.2. At the moment, webauth only supports
  2.0.x, as far as I know, but I would not worry about this much, as
  we can reasoanbly expect webauth to support 2.2 soon, and at worst
  it is probably trivial to get this working ourselves.

• Support for non-MIT users is important to Stellar. A typical case
  here is for a faculty member to "sponsor" an account for some
  external user; their requirement is that such a faculty sponsor
  be allowed to add such an account to the system. (In this case
  authentication is done via username/password, whereas MIT users
  typically use certificates). It does not seem that the idea of
  opening up our Kerberos name space to additional users in the "MIT
  community", as we discussed the other day, would be feasible in
  this case.

• Alumni are another use case for access via username/password.

• While Craig said that users without Kerberos IDs currently constitute
  about 8-9% of their user base, this is probably misleading, as the
  Kerberos-based number includes all MIT Kerberos users (via a feed
  from the Data Warehouse), and there are obviously many such users
  who have never used the system. (He did not have relevant numbers
  for this handy).

• He mentioned the UMich "Friend" package as a potential solution.
  This is an add-on to Cosign (though claims to be able to work
  with other SSO packages) which I looked at only briefly – it
  seems to be a bit of a kludge, and not very secure (it is
  email-based).

• He seems to be familiar with the Yale CAS system, and put in a
  plug for it. I responded (gently, I hope) that we were looking
  elsewhere.

Following up on another belated response, I am scheduled to meet
Wednesday with Nina Davis-Millis and Alex Brennen of Libraries.

Bob