title: AngularJs, WebAPI, JWT, with (integrated) Windows authentication
body: <p>I've asked a <a href="https://stackoverflow.com/questions/40749346/claims-based-authentication-with-active-directory-without-adfs">question</a> before and the answer that was given was correct but the farther I go down this rabbit hole the more I realize; I don't think I was asking the right question. </p>
  
  <p>Let me just explain this in the most simple terms I can... I have a AngularJS single page app (client), that points at an asp.net webapi (OWIN) site (Resource server?), and a separate asp.net "authorization/authentiation" server.</p>
  
  <p>The auth server will provide authentication and authorization for multiple applications. I need to be able to use the Authorize attribute in the resource server, as well as get a token from from angular. I also need to use windows authentication (integrated) for everything, no usernames or passwords. The claims information is stored in a database and needs to be added to the token.</p>
  
  <p>I've done a SSO style claims authoriztion implementation in asp.net core using openiddict with JwtBearerToken and 'password flow?' And wanted to try to do something similar (token, etc). I have a basic understanding of how that works from my previous implmentation, but I am completely lost trying to figure out how to get JWT working with Windows Auth. The answer to my previous question provided some good suggestions but I am having a hard time seeing how that applies in this scenario.</p>
  
  <p>Currently I have been trying to get IdentityServer3 to do this, using the WindowsAuthentication extensions, mainly pulled from the samples. But  I am really struggling to tie this together with the client and actually get something working. The current client and server code is below, mind you I really don't know if this is even close to the correct solution.</p>
  
  <p>Client:</p>
  
  <pre><code>app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
          {
              AuthenticationMode = AuthenticationMode.Passive,
              AuthenticationType = "windows",
              Authority = "http://localhost:21989",
              ClientId = "mvc.owin.implicit",
              ClientSecret = "api-secret",
              RequiredScopes = new[] { "api" }
          });
  </code></pre>
  
  <p>AuthServer: </p>
  
  <pre><code>app.Map("/windows", ConfigureWindowsTokenProvider);
  app.Use(async (context, next) =&gt;
  {
       if (context.Request.Uri.AbsolutePath.EndsWith("/token", StringComparison.OrdinalIgnoreCase))
              {
                  if (context.Authentication.User == null ||
                      !context.Authentication.User.Identity.IsAuthenticated)
                  {
                      context.Response.StatusCode = 401;
                      return;
                  }
              }
  
              await next();
          });
          var factory = new IdentityServerServiceFactory()
             .UseInMemoryClients(Clients.Get())
             .UseInMemoryScopes(Scopes.Get());
  
          var options = new IdentityServerOptions
          {
              SigningCertificate = Certificate.Load(),
              Factory = factory,
              AuthenticationOptions = new AuthenticationOptions
              {
                  EnableLocalLogin = false,
                  IdentityProviders = ConfigureIdentityProviders
              },
              RequireSsl = false
          };
  
          app.UseIdentityServer(options);
  
  
  private static void ConfigureWindowsTokenProvider(IAppBuilder app)
      {
          app.UseWindowsAuthenticationService(new WindowsAuthenticationOptions
          {
              IdpReplyUrl = "http://localhost:21989",
              SigningCertificate = Certificate.Load(),
              EnableOAuth2Endpoint = false
          });
      }
  
      private void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
      {
          var wsFederation = new WsFederationAuthenticationOptions
          {
              AuthenticationType = "windows",
              Caption = "Windows",
              SignInAsAuthenticationType = signInAsType,
              MetadataAddress = "http://localhost:21989",
              Wtrealm = "urn:idsrv3"
          };
          app.UseWsFederationAuthentication(wsFederation);
      }
  </code></pre>
  
  <p>EDIT: I see the auth endpoints requests for "/.well-known/openid-configuration" as well as "/.well-known/jwks" and I have the Authorize attribute on a controller action which is being called, but I dont see anything else happening on the auth side. I also added a ICustomClaimsProvider implmentation to the usewindowsauthservice WindowsAuthenticationOptions but that doesnt even get called.</p>