title: Windows and Token Auth for same WEB API
body: <p>Ok, I have this scenario.</p>
  
  <p>I have one WEB API which  will provide functionality to an intranet application, the idea is this application WILL not be visible to the outside world, so it wont have a login page.</p>
  
  <p>However, the web api will also be consumed by mobile apps outside the organization, so the webapi WILL be exposed via a public url.</p>
  
  <p>How can I make the authentication/authorization here to support both scenarios?
  1. Internal users will be able to consume the web api via the angular backend app without an explicit login page.
  2. External users via the mobile app will consume the web api with their active directory account.</p>
  
  <p>I found this:
  <a href="https://stormpath.com/blog/token-authentication-asp-net-core" rel="nofollow noreferrer">https://stormpath.com/blog/token-authentication-asp-net-core</a></p>
  
  <p>where I could easily replace the GetIdentity Method to go to Active Directory and check if user exists with that user and password, but on the intranet, I wont have that info.</p>
  
  <p>ideas please?</p>