Much web searching found a number of people asking similar questions, and the HTTP Authentication plugin for a single user Wordpress install. Unfortunately, this plugin didn't work "out-of-the-box" with Wordpress MU, so I ended up patching it. The modified plugin is available from http://www.sxw.org.uk/computing/software/wordpress-mu-http-auth.tar.gz
It's still tailored to my needs. There's no support for automatic blog creation, for example, although that would be trivial to add. I haven't looked at its integration with Wordpress in much detail yet, either.
To use it, you need to protect your wp-login.php and wp-signup.php files with something like:
Require group web/blog/create
And your wp-admin directory with:
This also checks group membership before permitting blog creation.
To install the plugin, copy the file into your wp-content/mu-plugins directory, and configure using the HTTP Authentication tab in your Site Admin menu.
If you install this, please let me know how you get on!
We've also got an additional patch for wordpress MU which makes it use an HTTPS site for blogs, rather than HTTP - I'm happy to share that on request.