[Zope] Help on identification

[Tiller, Michael (M.M.)]

I've tried looking through all the available user folder types and I'm still
not sure I understand which one is best for me.  Here is my situation:

I'm trying to setup a Zope server on our corporate intRAnet set.  We have a
formal system of authenticating users.  It is centralized.  I don't want to
go into too much detail, but suffice it to say that I can invoke a program
and it will tell me whether the person requesting my page has a valid
certificate and, if so, who the person is.

What is the best scheme for integrating such a program into the Zope
authentication and identification process.  Key things are:

1) The user does not provide a password, only the validity of the
certificate is checked.

2) How do I invoke an external program from Zope?!?

3) Are there any "out-of-the-box" user folders that can handle this?  I
couldn't find any.  If not, what is the best open ended product and what
would I need to do?

Thanks for any help.

--
Mike