title: Is it possible to authenticate from an external source while keeping authorization data local?
body: <p>I'm currently working to develop a companion web application to a main web app. The main web app has a regular ASP.Net identity provider, which I have full access to and can create endpoints against. </p>
  
  <p>I want to use just the username/password combo from the main application to Authenticate my users. The new secondary app will have provisions to authorize and maintain the users once they've been authenticated. </p>
  
  <p>I imagine a sencario where a person enters the creds into the secondary app and it's sent to the primary endpoint. Primary then responds with a CanLogin and IsAuthorized flags. The secondary app then lets the person in and they can from there request further authorization to the system to be approved first by admins. </p>
  
  <p>I've read over and over the ASP.Net Core documentation and I think something claims based is what I want. I just don't know at what point in the middleware I catch the authenticating method in order to check the primary?</p>