I've read the tutorials on creating custom login modules (http://dev.day.com/docs/en/crx/current/deploying/custom-login-modules.html) but I don't think this is what I need.
I need to allow a user of a application hosted on CQ to provide credentials that will be validated by an external service. The catch is that these users are only relevant in the context of the app, and conversly other users of CQ (admin, authors, etc) will not have credentials in this external service. If I'm understanding correctly, a custom login module as per the tutorial would require the admin to register as a user of the CQ-hosted app in order to perform admin functions in general, which is not appropriate.
My best guess is that I need to put something like Apache Shiro (http://shiro.apache.org/) in place to provide app-level login. Does CQ provide something similar out of the box? Am I missing something?
Thanks