Understanding Drupal's session management and user authentication
Drupal supports external authentication. There are many alternatives authentication modules for Drupal, such as OpenID (included in core), OAuth Connector, or LDAP. Learn more about how Drupal authentication works; the best would be to look at the OpenID and OAuth modules, and to the core login form submit callback. But, AFAIK, they always start the normal Drupal session after a successful authentication.

For session management, Drupal plugs into PHP session handling and register it own handlers. The Drupal session backend is itself pluggable, you can set the session_inc variable to the path of a file providing alternative implementations of the functions found in includes/session.inc. The memcache module use this to store session in memcached.

For references, the OpenID module handle successful authentication in openid_authentication() which itself ceats and call the user login form submit handler (ie. user_login_submit()). This submit handler itself is simple, it loads the successfully authenticated user with user_load() into the global $user variable, it then call user_login_finalize() which handle session, login timestamp in the user table and invoke hook_user_login() implementations.

Another option is the use the user_external_login_register() function. The function will log an external user in. It also creates a local user if needed. If you need more control on local user creation, you can always use user_save(), user_set_authmaps(),  user_login_submit() and user_external_load() from you custom call, using user_external_login_register() as template of what needs to be done.