I'd like to set up an OpenID provider for our group, which we can use to log in to internal and external OpenID-aware services (e.g. stackoverflow.com).
Our users all have X.509 certificates issued by our CA, so I think the ideal solution would use that to authenticate them (i.e. the provider shouldn't ask for a password). Maybe Apache FakeBasicAuth would work to extract the username from the SSL connection's certificate?
What would be the best software to use? Open Source preferred.