2
Look in the htdocs/class/auth directory for examples of alternate authentication mechanisms. There are existing implementations for Active Directory and LDAP.
Essentially, these alternates provision a XOOPS account to correspond to the existing user in the other directory service. The authorization (login) is performed using that other service, while the permissions in XOOPS are granted to the associated provisioned account for the user.
You can extend the existing mechanism by adding a new class extending the XoopsAuth class for your needs, and adding a configoption entry for it, following the examples set by the existing classes.