The problem can be traced to use of $_SERVER in auth.php. This appears to be another point where the values returned by MS IIS differ from Apache.
The microsoft website suggests that such authentication is impossible: however,
this page tells you how to go about it with PHP 4.3.3+ (near the bottom of the page, just above user comments). Haven't tested it yet, but I hope this helps.