That's the route I would have gone, just write some tiny local web app which authenticates against AD and then redirects to the external service.

I don't know why they wanted to go ip-based or even bother with cookies since AD queries are practically free.

In ASP.net with all the builtin integrations for AD that's a one day project.