I'm looking to create a web automation and administration area that users who have permissions to do system tasks can do them via them web, such as creating/editing users. I thought about making a system that syncs the system and web passwords, and when a user wants to do a specific task that requires root access, ask for their password for
sudo and save the password in a session for a certain amount of time.
However, I realize this isn't a good practice, and if someone got access to session information they would be able to get the passwords for the users. So that led me to think about a Central Authentication Service for the system and the web users.
My questions are, is this possible, or has it been done? If so, how would I accomplish setting up this CAS system for web users and system users? How would I allow these CAS users to perform sudo actions? And, what other implications should I consider for this project?