title: How does Katana relate to ASP.NET 5 applications on IIS?
body: <p>I understand what OWIN is, and it is good, and generally that Katana is a Microsoft implementation the standard in terms of the ASP.NET ecosystem.</p>
  
  <p>I've also read that Katana has only so far been designed to work with WebApi and SignalR, since these take no dependency System.Web. Cool.</p>
  
  <p>However, a new ASP.NET MVC 5 project template does include some Katana stuff and references Microsoft.Owin.Host.SystemWeb and that's where I get confused.</p>
  
  <blockquote>
    <p>"[SystemWeb] provides an OWIN server that runs in the ASP.NET request pipeline"</p>
    
    <p><a href="http://www.asp.net/aspnet/overview/owin-and-katana/an-overview-of-project-katana" rel="nofollow">http://www.asp.net/aspnet/overview/owin-and-katana/an-overview-of-project-katana</a></p>
  </blockquote>
  
  <p>So, on IIS, does a request off the wire flow through the Owin pipeline before being routed to a WebApi action? And MVC actions, too? At what point in the pipeline does Owin sit?</p>
  
  <p>Look at the following code from <code>ChallengeResult.cs</code> the template:</p>
  
  <pre><code>    public Task&lt;HttpResponseMessage&gt; ExecuteAsync(CancellationToken cancellationToken)
      {
          Request.GetOwinContext().Authentication.Challenge(LoginProvider);
  
          HttpResponseMessage response = new HttpResponseMessage(HttpStatusCode.Unauthorized);
          response.RequestMessage = Request;
          return Task.FromResult(response);
      }
  </code></pre>
  
  <p>This appears to be talking to two pipelines; it tells the authentication middleware on the Owin pipeline to send a 401 challenge and then also returns a 401 via the normal response messaging system.</p>
  
  <p>I'm sure its simple, but I'm confused.</p>