Check the archives for my emails - I'm doing this (on a 1.7.0 version,
IIRC) by replacing the default CGIs which check for an existing
valid cookie, if none is present it asks for authentication, when
you submit it gets the credentials and checks them against LDAP, and
if they are correct it will call the real cosign CGI with REMOTE_USER
already set which will trust the cookie and make everything work.
Details should be in my old emails, or I can send you the
package I've built up. Not terribly sexy.