There's also service bus - have a service bus connection tunneling through to the secure service, then ADFS to auth it (which is what I've ended up doing for a couple of things)