Hello,
The way the Customer Portal external authentication works (assuming you're not using the integrated mode), is by posting the credentials that the user enters on the login control in Customer Portal to a page specified in the Customer Portal Settings in OnTime. It is the responsibility of that page to validate the credentials, set a cookie that Customer Portal will be able to use to identify the logged-in user, and redirect the user to a page that is specified in the Url (in a querystring value). Customer Portal ships with a .Net assembly to do encryption on the cookie values, so currently there is a requirement that you be using a .Net language to set the cookie.
Let us know if you have any other questions.
Thanks!
Jonas Bush
Axosoft Development Team
Blog