C4::Auth::checkauth() can be a bit difficult to read. Take for instance the following code snippet unless ($userid || $sessionID) { ... } That makes it seem like this block will be executed if we haven't sent a userid in the CGI object passed to checkauth(). On the contrary, the userid in the CGI object has been defined as "$q_userid" so this block of code is actually what will be executed when we're logging in with a userid and password. The $userid mentioned in this condition refers to the "id" retrieved from an existing session or from "$userid = $ENV{'REMOTE_USER'}" (which is an environmental variable set via SIP?). So that's confusing. The whitespace is also inconsistent with the actual flow of logic, so that should be fixed up too. There are all sorts of little bits that need some explanatory comments.
Switched to authentication module as I feel inline code documentaiton should come under the specific module and I wanted it to turn up in my Authentcation Module Maintainer search ;). I agree Auth.pm needs better inline documentation, and I intend to add it during this cycle given the time.
While C4::Auth::checkauth() is a nightmare, this bug report doesn't really add value.