Currently, just looking at the administration guide doesn't let the reader know:

1. That Beaker supports the use of REMOTE_AUTH for authentication (and hence supports Kerberos via mod_auth_kerb, SAML via mod_auth_mellon, etc)

2. That the use of REMOTE_AUTH requires either configuration of an LDAP source so that Beaker can still fill in the display name and email address of externally authenticated users or else some other mechanism for pre-population of the required user entries in the database with a NULL password entry.