Here's the quick hack I've come up with so far:

All code modifications need to be done in the Everything::HTML module.
This paragraph in sub loginUser:

if(my $oldcookie = $query->cookie("userpass")) {
    $USER_HASH = confirmUser (split (/\|/,
        Everything::Util::unescape($oldcookie)));
}
[download]

change to

# IIS will set $ENV{AUTH_USER} to "domain\Username", if NT 
# authentication was successful. As I am not 100% certain
# if it always translates a UPN (user@domain.dnsname.com)
# to the backslashed version, I check for that case too.
#
# Please note that this chops off the domain, so there will be no 
# distinction between same usernames on different domains!
# You can secure that using file permissions.

if (my $ntuser = lc($ENV{AUTH_USER})) {
    if ($ntuser =~ /^([a-zA-Z0-9.]+)(\\|\@)([a-zA-Z0-9.]+)/) {
        if ($2 eq '@') {
            $ntuser = $1;
        }elsif ($2 eq '\\'){
            $ntuser = $3;
        }
    }
    # since authentication already happened, we don't need a password 
    $USER_HASH = confirmUser ($ntuser, undef);
} elsif (my $oldcookie = $query->cookie("userpass")) {
    $USER_HASH = confirmUser (split (/\|/,
        Everything::Util::unescape($oldcookie)));
}
[download]

and this line in sub confirmUser

if ($genCrypt eq $crpasswd)
[download]

change to

if (($genCrypt eq $crpasswd) or $ENV{AUTH_USER})
[download]

To allow anonymous access as well as the normal login and cookies, the index.pl needs two be duplicated (in this example: ntauth.pl). Then anonymous access gets disabled on ntauth.pl and it's file permissions being set to groups, which shall be granted to use NT login.

When creating a new User the username needs to match the NT username, for NT authentification simply ignore the supplied password and use the ntauth.pl instead the index.pl (the other password will work as well).

I decided to ignore the domain for two reasons, first being that it looks ugly in the username and second that we have an upcoming migration to a new domain (with a new name) which would render all accounts created before useless.

The above changes are kind of dirty, but it seems to work well and maybe some Monk has a great idea on how to improve that?
Greets,
Golo

P.S. I was not really sure on where to post it, since it's about perl but also about Everything. Also I wasn't really sure on where to post it on pm. So please accept my apologies, if it went to the wrong place.