You should be able to use Basic with with the Apache HTTPD LDAP module. There are options for caching results, which ought to mollify your IT department. The Samba wiki - https://wiki.samba.org/index.php/Authenticating_Apache_against_Active_Directory - has details, for example:

Basic LDAP authentication

Example of where you need this: You want Apache to permit access to a directory on your webserver just for AD users that are members of a defined AD group (I used group "test" in the example). Username and password should be validated against AD.

• Create a new user in ADUC or with samba-tool, that Apache will use for connecting to the AD (I used "apache-connect" in the example below).
• Add the following to your .htaccess or your httpd.conf (vHost/directory/... directive):

AuthName "AD authentication" AuthBasicProvider ldap AuthType Basic AuthLDAPGroupAttribute member AuthLDAPGroupAttributeIsDN On AuthLDAPURL ldap://{AD-Hostname/IP}:389/cn=Users,dc={your Domain DN}?sAMAccountName?sub?(objectClass=*) AuthLDAPBindDN cn=apache-connect,cn=Users,{your Domain DN} AuthLDAPBindPassword {password} require ldap-group cn=test,cn=Users,{your Domain DN}

With this configuration, the username is searched for just in the "Users" container and below. If you want to search in any OU of your domain, then you have to add

REFERRALS off

to your "/etc/openldap/ldap.conf". Otherwise accessing doesn't work and apache will log "auth_ldap authenticate: user xxx authentication failed; URI / [ldap_search_ext_s() for user failed][Operations error]!". If you're still getting this error after turning referrals off, set Apache to connect to Samba/AD port 3268 (AD global catalog) instead to the standard LDAP 389 port.

Make sure that your configuration file is only readable by the webserver, because of the password!

• Restart apache.

The same page also has configuration examples for browser SSO, which may be of interest.

You should be able to use Basic with with the Apache HTTPD LDAP module. There are options for caching results, which ought to mollify your IT department. The Samba wiki - https://wiki.samba.org/index.php/Authenticating_Apache_against_Active_Directory - has details, for example:

Basic LDAP authentication

Example of where you need this: You want Apache to permit access to a directory on your webserver just for AD users that are members of a defined AD group (I used group test in the example). Username and password should be validated against AD.

• Create a new user in ADUC or with samba-tool, that Apache will use for connecting to the AD (I used "apache-connect" in the example below).

• Add the following to your .htaccess or your httpd.conf (vHost/directory/... directive):

   AuthName "AD authentication"
   AuthBasicProvider ldap
   AuthType Basic
   AuthLDAPGroupAttribute member
   AuthLDAPGroupAttributeIsDN On
   AuthLDAPURL ldap://{AD-Hostname/IP}:389/cn=Users,dc={your Domain DN}?sAMAccountName?sub?(objectClass=*)
   AuthLDAPBindDN cn=apache-connect,cn=Users,{your Domain DN}
   AuthLDAPBindPassword {password} require ldap-group cn=test,cn=Users,{your Domain DN} 
  

With this configuration, the username is searched for just in the "Users" container and below. If you want to search in any OU of your domain, then you have to add

REFERRALS off 

to your /etc/openldap/ldap.conf. Otherwise accessing doesn't work and apache will log auth_ldap authenticate: user xxx authentication failed; URI / [ldap_search_ext_s() for user failed][Operations error]!. If you're still getting this error after turning referrals off, set Apache to connect to Samba/AD port 3268 (AD global catalog) instead to the standard LDAP 389 port.

Make sure that your configuration file is only readable by the webserver, because of the password!

• Restart apache.

The same page also has configuration examples for browser SSO, which may be of interest.