Web Server using AD Authentication

I think your best bet would be to keep your web server on the internal network, which would give your domain users access. Then use ISA Server to publish the server. I had a web server set up like this way, and it was very secure and worked very well. The ISA server would be on the perimeter with 2 NICs one on the internal network, and the other on the DMZ. Your primary firewall would redirect port 80 requests to the ISA's DMZ NIC
The ISA server would then process the request. The Web server would be in effect double fire walled. From what I understand, there are no cases of a Web Server being compromised being published by an ISA Server.

Putting 2 NICs in the web server, one on the DMZ network and one on your internal trusted network, would bypass the whole DMZ security! IF someone were to compromise the web server, then they could jump to the internal network from it, since it has a leg ON the internal network.
You really don't want to have a DMZ server have a leg on a trusted internal network. Bad security.

The way to handle this really depends on your company's security policy for communication from a DMZ to the internal network. Can any machine on a DMZ initiate communication to an internal trusted network machine? PRobably not.

What I have heard for DMZ and AD users is you set up a NEW Active Directory domain ON the DMZ. A brand new one. One that does NOT talk to your internal AD domain. No Trust between then. Nothing. Then you tell the users that they will have a different username/password to access the web server. The web server is a part of this external DMZ AD domain, and uses Windows Authentication from this DMZ AD domain for credentials. The web server also only has 1 NIC, on the DMZ. It has NO connectivity to the internal trusted AD domain or the network.
So, doing it this way does not allow you to use your internal network AD usernames/passwords. Yes, you have another set of usernames/passwords. But, if the web server were to be compromised, all that is gonna be at risk is the DMZ AD domain, and that, from what I have heard/read, is an acceptable level of risk. The internal network AD domain is safe.

hope this helps

I may be inexperienced here, but I don't understand why you would want the web server in the DMZ. I would install firewall software and just open up port 80 and whatever other ports needed for your web app.

For more security, you could find an old PC and use the free software from http://smoothwall.org to setup a firewall between the web server and the outside world.