Here is a PAS plugin that I created this week, for getting information out of request headers:
Actually, I first started coding this in May 2017, but it was buried in other client code.
I cleaned it up and made it more general. Note: I’m still busy with it, and not using it yet. (The original code is working fine in a Plone 4.3 site.)
It should serve as a nice example of how to code a PAS plugin. A couple of months ago I copied the original code to a new project in Plone 5.1. The logic in the various plugin methods needed to be very different, but the basic code structure held up nicely.
It doesn’t do user enumeration though.