When we have the requisite infrastructure, we plan to add PKI to the possible authenticaiton options. It then passes the user's identity on to the web resource. If the login form is used, the user's identity is passed from the web-login server to the target web server within a cookie. We currently use proxy mode, for instance, in conjunction with the local WebGrades application. In this case, the authenticating server will pass the user's identity on to the real target server within the HTTP headers.
Authorization works from the standard htaccess file.
In native mode, end users maintain the htaccess files. Currently, sysadmins have to maintain them.