I ended up using isapi_rewrite, but your mod_auth_kerb suggestion is illuminating and I'll keep it in mind as I approach production. Thanks all!
Oh, I thought that if you are using a server with Windows, then perhaps you may find it easier to use Apache with sspi_auth_module. I no longer use Windows, and completely forgot about this module.
Andrey