Impersonating a user profile from PHP, Python or other web language

Hello,

I'm contemplating writing a REST service for dealing with source members
that would work on any IBM i. Naturally, security is important here, and
I'd want things to run with a users user profile, not the user profile that
apache is running in.

So, each language has an ibm_db module with connect/pconnect calls that
will either take a trusted context as the user PHP runs as, or a user name
and password. The XML service seems to require a name and password.
Ideally, I want the users to transmit names and passwords once to get a
token, and then use that token for the rest of their session. Or even more
ideal would be something like kerberos where there were time sensitive
tickets.

Do I have this option on the IBM i? This is pretty important to me for this
project. I'd pick my language for this particular project solely on who has
the best security model for impersonating real user profiles.

BTW my ultimate goal once I wrote the REST API would be to morph it into a
WEBDAV implementation thats good enough for windows and MACs to mount and
most text editors to edit the files directly. Another solution, hardest for
me to write, and completely out of scope of web programming would be a
module for SAMBA to expose source members as a UNC mount. If any of these
things exist, please tell me so I don't waste my time. I have plenty of
windmills to tilt.

Justin