That's the route I would have gone, just write some tiny local web app which authenticates against AD and then redirects to the external service. I don't know

That's the route I would have gone, just write some tiny local web app which authenticates against AD and then redirects to the external service. I don't know why they wanted to go ip-based or even bother with cookies since AD queries are practically free. In ASP.net with all the builtin integrations for AD that's a one day project.