(I am not sure I am posting this to the right group - if not, please advise
on a better group to use...)

I am looking for a way to allow end-users to use Single Sign-on to log in to
a hosted web-based application, i.e. using their normal windows UID/PWD - or
just having the normal transparent auto-authentication going on.

Background:
We provide a web-based employee self-service module as part of our offerings
to clients. When they install our systems locally, it is fairly easy to
provide SSO: We just deny anonymous access to the login page which causes IIS
to authenticate the user against AD and we get a SID. Depending on the user's
settings, this will either happen automatically or the browser will prompt
him/her to re-enter their UID/PWD.
We do also offer a hybrid solution where all of the above takes place, but
we still get them to type their PWD into a form to re-authenticate and then
we check that against AD - but we can leave that out of this discussion for
simplicity.

Now, we also provide this software in a hosted environment where we
obviously haven't got access to the client's AD so can't do any of the above.
Our client's would - obviously - like SSO on the hosted system, but there
doesn't seem to be a simple way of doing it.
We could potentially set up a VPN and/or some trust, but it seems like a lot
of work. Or we could get a copy of all their UIDs and PWDs but I don't think
they would be keen to give us their passwords... Part of the "problem" with a
hosted system is that the whole message to the client is that their IT Team
doesn't have to get involved, so whatever solution we come up with has to be
quite transparent.

I am thinking that maybe the solution is something like this;
1) Create our own authentication method in IIS which will allow users to
have the same experience - i.e. invisible login. This would probably mean
exposing something like the same challenge/response as is used, rather than
using clear-text. I am not even sure if that is possible, though.

2) Get the clients to agree to give us a list of all UID/PWDs but with the
passwords hashed (one-way, lossy so there is no way of decrypting). We'd
create a little program on their side which would push this list to a
webservice on the hosted system every so often.

3) Somehow get our own login method to look like a normal challenge/response
but then compare against the hastable.

Truth is, I am not that well versed on IIS authentication methods yet so I
am really looking for pointers.
Some of the things I am looking to explore includes cardspace, OpenID etc -
but I think they all require individuals to sign up.
There is SAML, which Google are using, but I don't think AD supports that
readily.
ADAM or some similar AD replication may also work?

In any case, I think this is a fairly generic problem that most providers of
hosted software must come across and I'd be interested to get any pointers to
standard solutions. Much better if I don't have to build it myself :)

Thanks,
Frans