Tomcat / XWiki isn’t aware of the Active Directory user when using an http reverse proxy. Right now we have separate accounts within XWiki. The main goal behind us using IIS as a reverse proxy was to have the server logs (now in IIS) reflect the Active Directory account for each user request.
We did get a IIS reverse proxy using ISAPI redirector / AJP working which passed the Active Directory user information to Tomcat; however, users with a lot of credentials (OUs) experienced the “request entity too large error”. Increasing the packet size did not solve the issue. We therefore pivoted to using an http reverse proxy instead of ISAPI / AJP.