AngularJs, WebAPI, JWT, with (integrated) Windows authentication
<p>I've asked a <a href="https://stackoverflow.com/questions/40749346/claims-based-authentication-with-active-directory-without-adfs">question</a> before and the answer that was given was correct but the farther I go down this rabbit hole the more I realize; I don't think I was asking the right question. </p>

<p>Let me just explain this in the most simple terms I can... I have a AngularJS single page app (client), that points at an asp.net webapi (OWIN) site (Resource server?), and a separate asp.net "authorization/authentiation" server.</p>

<p>The auth server will provide authentication and authorization for multiple applications. I need to be able to use the Authorize attribute in the resource server, as well as get a token from from angular. I also need to use windows authentication (integrated) for everything, no usernames or passwords. The claims information is stored in a database and needs to be added to the token.</p>

<p>I've done a SSO style claims authoriztion implementation in asp.net core using openiddict with JwtBearerToken and 'password flow?' And wanted to try to do something similar (token, etc). I have a basic understanding of how that works from my previous implmentation, but I am completely lost trying to figure out how to get JWT working with Windows Auth. The answer to my previous question provided some good suggestions but I am having a hard time seeing how that applies in this scenario.</p>

<p>Currently I have been trying to get IdentityServer3 to do this, using the WindowsAuthentication extensions, mainly pulled from the samples. But  I am really struggling to tie this together with the client and actually get something working. The current client and server code is below, mind you I really don't know if this is even close to the correct solution.</p>

<p>Client:</p>

<pre><code>app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
        {
            AuthenticationMode = AuthenticationMode.Passive,
            AuthenticationType = "windows",
            Authority = "http://localhost:21989",
            ClientId = "mvc.owin.implicit",
            ClientSecret = "api-secret",
            RequiredScopes = new[] { "api" }
        });
</code></pre>

<p>AuthServer: </p>

<pre><code>app.Map("/windows", ConfigureWindowsTokenProvider);
app.Use(async (context, next) =&gt;
{
     if (context.Request.Uri.AbsolutePath.EndsWith("/token", StringComparison.OrdinalIgnoreCase))
            {
                if (context.Authentication.User == null ||
                    !context.Authentication.User.Identity.IsAuthenticated)
                {
                    context.Response.StatusCode = 401;
                    return;
                }
            }

            await next();
        });
        var factory = new IdentityServerServiceFactory()
           .UseInMemoryClients(Clients.Get())
           .UseInMemoryScopes(Scopes.Get());

        var options = new IdentityServerOptions
        {
            SigningCertificate = Certificate.Load(),
            Factory = factory,
            AuthenticationOptions = new AuthenticationOptions
            {
                EnableLocalLogin = false,
                IdentityProviders = ConfigureIdentityProviders
            },
            RequireSsl = false
        };

        app.UseIdentityServer(options);


private static void ConfigureWindowsTokenProvider(IAppBuilder app)
    {
        app.UseWindowsAuthenticationService(new WindowsAuthenticationOptions
        {
            IdpReplyUrl = "http://localhost:21989",
            SigningCertificate = Certificate.Load(),
            EnableOAuth2Endpoint = false
        });
    }

    private void ConfigureIdentityProviders(IAppBuilder app, string signInAsType)
    {
        var wsFederation = new WsFederationAuthenticationOptions
        {
            AuthenticationType = "windows",
            Caption = "Windows",
            SignInAsAuthenticationType = signInAsType,
            MetadataAddress = "http://localhost:21989",
            Wtrealm = "urn:idsrv3"
        };
        app.UseWsFederationAuthentication(wsFederation);
    }
</code></pre>

<p>EDIT: I see the auth endpoints requests for "/.well-known/openid-configuration" as well as "/.well-known/jwks" and I have the Authorize attribute on a controller action which is being called, but I dont see anything else happening on the auth side. I also added a ICustomClaimsProvider implmentation to the usewindowsauthservice WindowsAuthenticationOptions but that doesnt even get called.</p>