First of all you need an Advanced Authentication server. In CA Mobile API Gateway we have build assertions that can be used to communicate with that server.
Answers to questions:
I hope this helps!
For the Mobile API Gateway, there is a topic specifically for CA Advanced Authentication Integration. This page includes the following information: