Currently the headers are needed on every page. When the headers are gone, you are no longer logged in. It would be useful if you stay logged in. Then a frontend server (nginx, Apache) only needs to check for example SAML or CAS only for one, or a few, pages.

• We can set an __ac cookie by calling self._getPAS().updateCredentials.
• That will call updateCredentials from plone.session.
• For that call to work, a user must be found. That can only work when our plugin supports enumerateUsers, although possibly a user with the same id can be found from LDAP or elsewhere.

So:

1. Implement enumerateUsers (this will either return one user or none, depending on the headers).
2. Call updateCredentials. I think we would call this from authenticateCredentials.

Ah, or we would just call _setupSession from plone.session directly.