I'm working on OpenPortalGuard (openportalguard.sf.net) whose prime domain
of operations is transport level authentication (ssl handshake) with
smartcards but should also support username/password.  It is still in the
design phase.  So the whole thing may be an overkill.

But what may be more useful are some of the links in the wiki
(http://openportalguard.sourceforge.net/wiki/index.php/Links/HomePage)
[also including CAS and Pubcookie that Dan already pointed out] and maybe
design considerations
http://openportalguard.sourceforge.net/wiki/index.php/Specification/HomePage.

A very good article on security issues is
http://www.pdos.lcs.mit.edu/papers/webauth%3Asec10.pdf

hope this helps
-b