Drupal 7 External Authentication Module Workflow Design

I'm working on an ldap authentication module as part of the ldap project for drupal 7. Since other external authentication modules need to migrate to 7 and this functionality is critical to security, I wanted to get some feedback on d7 workflow, hooks and functions related to authentication.

Please let me know if there is other good discussion and resources on this besides api.drupal.org, http://api.drupal.org/api/drupal/modules--user--user.api.php/7, the drupal core issue queue, and http://drupal.org/update/modules/6/7 Or any d7 code from other external auth modules. If we get a good discussion here, I'm willing to write up the results in a sample module for http://drupal.org/project/examples or some documentation in http://drupal.org/developing/modules

I see at least two types of external authentication workflow:

1. Credentials entered in drupal: enter credentials on drupal site, module verifies, and logs user in.
2. Externally entered credentials: drupal login based on cookie, webserver, token etc such as kerberos, webserver authentication, open id.

I'm interested in case 1. for the ldap_authentication module. Below are my initial notes/psuedo code on workflow that I'm looking for feedback on.

/**
 * Implementation of hook_form_FORM_ID_alter().
 */

function ldap_authentication_form_user_register_alter(&$form, $form_state) {
  /**
   * - remove any fields from form that are not appropriate if user is authmaped to
   *    this module.  such as password, email address, username.  Perhaps
   *    offer directions on external site for password change, help etc.
   */
}


/**
 * Implementation of hook_form_FORM_ID_alter().
 *
 * alter both user_login block and page forms
 */

function ldap_authentication_form_user_login_block_alter(&$form, $form_state) {
  ldap_authentication_form_user_login_alter($form, $form_state);
}

function ldap_authentication_form_user_login_alter(&$form, $form_state) {

 /**
  *  sort, add, and remove from  #validate array
  *
  *  user_login_name_validate() (always  called first)
  *  
  *  user_login_authenticate_validate() (remove if only using external auth; not mixed mode)
  *  ldap_authentication_login_form_validate()  (may be before or after user_login_authenticate_validate)
  *  user_login_final_validate() (always last, checks for flood control)
  *
  *  
  */

 
  /**
   * sort, add, and remove from #submit array
   *
   *  ldap_authentication_login_form_submit() must come before user_login_submit
   *    in order to create users and enter in authmap.  Otherwise
   *    we will not be able to leverage standard user login flow.
   *    
   *  user_login_submit() function finalizes login process. user_login_submit
   *    will call user_login_finalize and user_load
   *    which is where we will use hooks to add any ldap attibutes to user data/object
   */  

}


function ldap_authentication_login_form_validate($values) {
  
  /**  will be called between  user_login_name_validate() and user_login_final_validate() **/
  
   /** errors scenarios:
    * can't bind to ldap server with service account.
    * can't find user via ldap query with binding credentials
    * can't find user via ldap query with user entered credentials
    * invoking hook_ldap_authentication_valid_user() returns false with message
    * credentials fail test
    *
    * set form error. ends login process?
    */

}


function ldap_authentication_login_form_submit() {
  /** user has successfully validated and credentials succeeded.
   * if user authenticated via local drupal user account, exit
   *
   * otherwise see if account needs to be created and login
   * this can be done with one function call:
   *  user_external_login_register($drupal_user_name, 'ldap_authentication');
   *     which will create and login the user
   */

}



/** ====================  VARIOUS D7 login/user HOOKS TO PONDER ============================== **/
  
/**
 * Implements hook_user_login().
 *
 * The user just logged in.
 * 
 */

function ldap_authentication_user_login(&$edit, $account) {
  
}


/**
 * Implements hook_user_presave().
 *  A user account is about to be created or updated.
 */

function ldap_authentication_user_presave(&$edit, $account, $category = NULL) {
  
  /** any ldap data stored in user.data array should be reset here
   * if using ldap user attributes to map to .data array
   */
  
}


/**
 * Implements hook_user_insert().
 *
 * A user account was created.
 * The module should save its custom additions to the user object into the database.
 */

function ldap_authentication_user_insert(&$edit, $account, $category) {
  
}


/**
 *  Implements hook_user_update().
 *  
 *  A user account was updated.
 *  Modules may use this hook to update their user data in a custom storage after a user account has been updated.
 */


function ldap_authentication_user_update($edit, $user, $category) {
  
}