This depends somewhat on how your Tomcat app gets secured. If the webapp has its own user-designed login code, you have a challenge on your hands. Whatever solution your come up with will be yours and yours alone, just like the app's login code.
On the other hand, if the webapp is delegating login to the container using the
J2EE container-managed security system, then the login (or lack of it) becomes the responsibility of whatever Realm implementation you use.
There is at least one Realm module that will work with Windows User security. There is also at least one Realm module that allows you to combine Realms so that for example, Windows (LAN) security may be combined with a more general solution such as a database or LDAP service.
Although before getting too creative in that regard, I should observe that you're probably better off letting IIS proxy ALL user requests targeting Tomcat, and not just some of them. Or if you have reasons for not using IIS for the non-LAN users, use something like Apache, which can present its own security interface while simultaneously eliminating some of the problems with Tomcat connecting to the open Internet directly. If you use IIS, I would hope that there's a way for IIS itself to manage the login process for the non-LAN users. Since I haven't worked with IIS in many, many years, I can't say for sure about that, however.
