How to setup IIS/NGINX reverse proxy (in front of NodeJS) with windows authentication

Question

I currently have a nodeJS app server running on windows that uses node-sspi to authenticate windows network users like this...

app.use(function (req, res, next) {
    var nodeSSPI = require('node-sspi');
    var nodeSSPIObj = new nodeSSPI({
        retrieveGroups: true
    });
    nodeSSPIObj.authenticate(req, res, function (err) {
        res.finished || next();
    });
});

this works well!

I now want to move the nodeJS server to linux and add a proxy server in front. node-sspi ONLY runs on windows. so would need the proxy server to be able to authenticate windows users (what node-sspi does in the current setup) and forward the request then to the nodeJS servers running on linux.

I've played around with IIS with ARR as proxy server.. was able to get it running as a proxy but couldn't make the windows authentication work. has someone here done this before?

I'm also open to NGINX for the proxy/authentication role. thanks in advance.