I have a website running an ISAPI filter providing SSO functionality, as well as anonymous & basic authentication.
The ISAPI filter populates the "Authorization" header of each request with basic credentials e.g. basic base64EncodedString (username:password), which I can see using Fiddler.
Next I have an HTTP Module picking up the basic credentials from the "Authorization" header, decoding them and placing the username in a new header value. The new header is then picked up by Tridion and used by the inbuilt SSO module.
This solution works in IIS6, but not in IIS7.5; in IIS7.5 the "Authorization" header is not present in the request. I checked for the header both in the HTTP Module, and in a dummy ASPX page.