If you're doing what this looks like, see Apache's mod_auth*. It will do all the work for you, leaving $ENV{REMOTE_USER} for you to see - already authenticated.