There are few transparent methods for this, unfortunately.
In a centrally managed network, you could possibly use Kerberos, with mod_auth_gssapi or mod_auth_kerb on the web server side (aka "HTTP Negotiate"). Kerberos is very secure, but can be a pain to configure for web usage (not all browsers support it, and only some allow it by default).
If all the computers are trusted (i.e. users are guaranteed to not tamper with root-installed software), the Ident protocol (RFC 1413) is a possibility, but the authentication it provides is very weak.
But most often, your only option is to ask for a password.
If the users have accounts in
/etc/passwd, as mentioned in your comment, running a privileged program is unfortunately the only way to verify a received password against/etc/shadow.If you do this, don't write your own scripts through
sudo, because you will get input validation wrong the first time, and because it's a solved problem already. Pick something well-known, for example Cyrussaslauthd(which can run in-a pammode); that way your website will not need any privileges beyond connecting to thesaslauthdsocket.