>as a test, if i write a custom authentication script that simply returns true for the authenticate() method, would that work (all users authenticated)? or should i take care of something else besides that? like some gluu session etc
It *should* work, but even if it doesn't, why won't you just leave the call to this function intact (NOT commenting it out), and just place an override for "logged_in" right after it? I.e., experiment a little, try to read the related code at Github etc - that's the part of the deal of being Community (free) user. Unless you are willing to pay for support, we can't afford to spend time of our dev team answering such in-depth questions here.
Also, if you'll suceed you are welcome to leave a note for the rest of community here, explaining how to achieve this - this is how community works.