I haven't done it personally, but I know it can be done. Microsoft does
that on several of its externally available sites, on both WSS3 and
MOSS.

We initially played around with using ADAM for our secondary
authentication source. It does work. You can connect to it with the
AD Membership provider using an LDAP connection string.

We decided against using it and went with anothe full active
directory using FBA, as it was easier for our helpdesk to manage the
users.