Shibbolizing a self contained web app

[C G]

Good Friday morning!

Appreciate if I am pointed in the right direction... I do not have much sp experience (but more on Idp end :)

We have a self sustained web app on iis with its own login and password store. 

We want to add a layer to that local authentication. As such we are looking at a two step process a) first auth happening on Idp with shib sp intercepting and creating a valid session for the app we are looking at and b) the next step of local authentication as regularly 

What are the options or how is it done to ensure Userid is consistent across two steps ?

Use of remote_user session variable, but web app is old and we don't have access to code to modify 

I am sure this is a well understood problem :) and solved?

Many thanks in advance 
With best regards
CG