Deploying single sign on using AD

  

Is it possible to implement single sign on, using AD?

Yes, it is possible.

  

How will my legacy applications communicate with AD?

Depends on the legacy application. In C #, from the framework 3.5, this authentication can be done as follows:

using System.DirectoryServices.AccountManagement;

using (var pc = new PrincipalContext(ContextType.Domain, "SEUDOMINIO"))
{
    bool loginValido = pc.ValidateCredentials("usuario", "senha");
}

  

Will you have a WS?

It all depends on how you want to organize your architecture. It's possible to do it for WS, but I do not recommend going down this path because WS is an old approach. There are better ones, like the IdentityServer .