It does a simple GET request to a URL.
However, the Zimlet uses the proxy URL feature of the Zimlet API to tunnel all requests through the Zimbra server. The Zimlet-proxy feature is a lifesaver as it gets around the limitations of cross-site XML-HTTP calls. This is also what drives the Yahoo Maps Zimlet, which I referenced heavily while putting this one together.
The information that is displayed in the popup is generally "public" directory info at our EDU, so security is not an issue. If I were to implement security on the request, I would grab the users authentication cookie via Javascript in the wsuldap.
js file and pass it to the external URL that processes the request for validation along with the query. This general idea should work with CAS or any other single-signon style auth systems.
I've attached a basic version of the Zimlet here in case anybody finds it to be a useful base to start with.
The code is actually very generic and really has nothing to do with LDAP in particular, since it only:
1) Looks for a regex to match (see line 9 of com_zimbra_wsuldap.xml)
2) References your own HTML/lookup page (see lines 16 of com_zimbra_wsuldap.xml and line 106 of wsuldap.
js)
By changing these things, anybody should be able to easily customize the Zimlet to match (mouse-over) on anything and bring up any URL in the popup window.
We're also working on the SCT Banner course lookup module, which will be just a slightly modified version of this Zimlet.
Oh yeah, you will also need to add your target URL to the allowed proxy URLs in your Zimbra config and restart the server, otherwise, you will get a 'forbidden' error.