There are multiple stories of public facing applications with Microsoft active directory as the source of user accounts that speak to the worst examples of this.

I was involved in such an attempt but it never got off the ground.