So I have this black box authentication method, handed down to me from the accounts people, which basically amounts to ldap_bind($connection, $username, $password)
when the user logs in, give them a randomly generated "session cookie" (not strictly a session cookie because it will last longer than the browsing session) and store tuples of:
user_id | cookie_id
then hookup the cookie_id join the user_id with your user table and off you go.