We need a single sign on

My two routers are connected by a bridge and I would like to determine what devices access our network using the two routers. I am searching how to perform network mapping.
Basically, we need a single sign on, for users to connect to our intranet when they are in the office and connect through a virtual private network where they will be able to view the intranet.
The problem is if accessing the intranet outside the office, users need to enter their active directory user name and password to validate their access via lightweight directory access protocol (LDAP) because authentication falls to forms authentication. How can we avoid going through this? Thanks.
