Hmmm.... intresting question. However, didn't you think of a more direct solution, such as "Reading /etc/passwd and /etc/shadow, pharsing it, and whatnot?" Having a daemon copy /etc/shadow over so that's it's readable by Apache's user is also a better, simpler idea which goes well with it, and I think Perl's "crypt" has some code you can use to verify that a password is legit or not.

--
$Stalag99{"URL"}="http://stalag99.keenspace.com";