The script on Apache could write an entry into a file/database for the host address (IP - it just has to be the same for this session, so I doubt it'd change) and a randomly-generated string of characters (the more the better, but don't go mad!). After authentication, have the Apache page redirect to the IIS server, and pass it the variable. The IIS can then check to see if the remote address and the variable passed match those in the file/database. If they do, remove the entries and accept authentication. If they don't match, don't let 'em in!
Hope that helped.
Dave