In order to support LDAP and other authentication schemes (e.g., CGI-based authentication), UserContext should support a new AuthenticationScheme interface with the default implementation of BasicAuthenticationScheme (username and password) implemented out of the box. New authentication schemes could be introduced by writing a new implementation of AuthenticationScheme and then wiring it in through the API configuration files. Ideally, substitution (or addition) of the authentication scheme would be protected (e.g., limited to the configuration file setting or not easily done through the API) so that random code could not easily substitute a bogus authentication scheme to subvert proper authentication.

Initial design discussions occurred in this thread. Additional notes on this developers forum.

Talk thread: https://talk.openmrs.org/t/openmrs-and-sso/1757