[enquiry] SAP Fiori setup with SSO enable

Hi SSO expert,

I have a case for SAP Fiori setup. And the landscape should include:

1. SAP WebDispatcher     (DMZ) (for URL redirection)
2. Frontend Apps Server (SAP NW Gateway) (prefer ABAP only , and it is standard, right?) and in DMZ with same machine of SAP webdispatcher if possible.
3. Backend Server (SAP ERP 6.07 ) (ABAP only)

I read though below blogs and link which are quite useful, but still...there are some question I didnt come across yet with some special requirment of my case.

http://scn.sap.com/docs/DOC-50394

http://scn.sap.com/docs/DOC-50394#comment-632927

http://scn.sap.com/thread/3692840

Condition:  

C1. access from external network is required (which mean NO windows AD authentication possible...I believe)

C2. the login have to be same as Windows AD login AND PW  (<-- main issue...is it feasible?)

Question:

Q1. can i get rid of AS JAVA in my landscape? 

Q2. since the Frontend Apps server is ABAP only, that mean the user account must be created manually in it, and NO other option, right?

Q3. as i know, Fiori frontend apps server --> via Trust RFC --> ERP backend....so that mean same user account/name should be maintained in both     

       severs, right?

Q.4 What's the approach to achieve C2?   If not possible, any advise to revise the landscape plan?

Please try suggesting me base on the condition.

Regards

Gary