Authorization method for REST API utilising Active Directory
<p>What is the best method of securing a REST Web API with the following requirements.  The system has an Angular JS frontend with the REST APIs implemented in ASP.net.</p>

<ul>
<li>There are two "roles" in the system, users will have one of the
roles.  One role should allows access to some APIs (call it "VIEW"),
the other role allows access to other APIs</li>
<li>All users are in Active Directory, so if I have a username, I can check what role they are in- Some clients are on Windows boxes, the others are on Linux</li>
<li>I would like to persist the session so I don't have to look up AD for every API call</li>
<li>I would like single sign on.  On the Windows machines, I don't require them to enter user and pass as I already can retrieve their username using Windows Authentication.</li>
</ul>

<p>I believe that Oauth would be my best option.</p>