We will be hosting a web app on a server in the DMZ. This server is not a member of the domain. The users have existing AD accounts. How can I authenticate my users of this web app against AD?
You've got two options.
Mr. Denny's answer is valid. However there is a third and at times more robust solution:
Setup ADFS to handle Single Sign-On and authentication for your application by using AD as the user backing repository. This is scalable to support any future applications and supports a secure environment for remote users with a Federation Proxy server as well as an internal Federation server that will still utilize standard integrated authentication.
ADFS is the more extensible solution but requires more work on the admin and dev level to set it up and build in integration. Luckily setting up the application is pretty straightforward using the Windows Identity Foundation SDK.