I don't think I explained it correctly, but I think I am talking about an alias.

Let me try again.

A CGI program (I thought FOP2 was written in Perl like FOP waas) can pull ENV vars from the HTTPD server on the server side.
If a user logins via HTTPD, the HTTPD server creates an ENV var called REMOTE_USER.
I am suggesting that you allow authentication to happen at the HTTPD level and then map or alias the REMOTE_USER to an extension and log in the end user as the extension that is mapped to the REMOTE_USER value without needing to re-authenticate with FOP2 directly.

Simple example is adding something like this to the .htaccess inside /var/www/html/fop2:
AuthType Basic
AuthName "FOP2"
AuthUserFile /<path to .passwd file>/.passwd
Require valid-user

Then when a user hits the FOP2 site apache will ask for a user/password and authenticate against the AuthUserFile (there are multiple ways to authenticate on the HTTPD side). The REMOTE_USER environment variable will be created and FOP2's CGI program can pull that REMOTE_USER value and compare to the fop2.cfg file for an alias.

Then I (and other admins) can use HTTPD to authenticate against LDAP or MySQL or pam.d or IMAP, etc and fop2 only has to know about the REMOTE_USER environment variable <-> fop2.cfg alias map and does not need any new authentication scheme to allow all those authentication types that are built into HTTPD already.

Yes, exactly

Add http authentication, so that we can use HTTP, LDAP, MySQL, etc to authenticate users.

I suggest adding something like this to the user definition in the fop2.cfg:
user= EXTENSION : SECRET : PERMISSIONS : GROUPS : PLUGINS : HTTP USER NAME

Then when fop2 goes to display the login screen it checks to see:
if ($ENV{'REMOTE_USER'} =~ /^HTTP USER NAME$/i) {
# User is already logged in via HTTP skip auth, and login user as EXTENSION
} else {
# Display login screen:
}

If there are a large number of extensions it may be easier to specify ALL and then subtract the extension you don't want.
Like:
perm=supervisor:dial,spy,chat,preferences:All,-SIP/101

Instead of:
perm=supervisor:dial,spy,chat,preferences:SIP/102,SIP/103,SIP/104,SIP/105,SIP/106,SIP/107,SIP/108,SIP/109,SIP/110

Or maybe allow ranges:
perm=supervisor:dial,spy,chat,preferences:SIP/102..110

I the idea is that for admin extensions you can hide their button from everyone but the other admins.
This makes it easy to hide 1 extension so you don't have to create a group (or multiple groups) just to hide the admin button.