Another alternative for authentication, which is used by Moodle, is IMAP. Most email servers offer an IMAP interface and it works by the user supplying their email user name and password. The software then tries to log into their email using these credentials (IMAP uses 'telnet/no echo' as an interface for this). It doesn't do anything with the email, but it can detect whether the login has succeeded by examining the return strings and use this to confirm their identity. Users are normally more careful about sharing their email username and password than they are about sharing their institutional credentials! All that Xerte has to do is to hold a list of usernames and/or email addresses - it doesn't need to store the passwords.
