what is the current state of user authentication? is it good to go with openid or another alternative, or we still have to write our own user/password?
+1
A:
Take a look at: http://stackoverflow.com/questions/2601334/pylons-authentication
But, the direct answer to your question:
You could use RPX along with openid as mentioned on Tony Landis' blog