Should I use IIS as a trusted proxy to provide ActiveDirectory SSO for a legacy application?

I am trying to add Active Directory single sign-on support to an existing SOAP server. Since it is written in C ++ using third-party transport components, adding AD SSO is not straightforward.

So I think IIS is required as a trusted reverse proxy and let it do Active Directory authentication to the SOAP server. That is, offload all the authentication responsibilities to IIS and just rely on the X-Remote-User HTTP header on the SOAP server. Since the SOAP client uses the WinInet API, all of the authentication is performed for us, and this enables one-way login to the SOAP server.

client 
    -> IIS (Active Directory authentication) 
        -> SOAP server (with X-Remote-User: USERID header)

      

        
        
        
      

    

It looks like this should be a fairly common space of problems, however, while I found several IIS proxies, I thought it might be something built into IIS.

Is this functionality built into IIS or do I need to create a proxy myself?

Is there a better option than the IIS requirement?