asp.net core - What is the correct way to use Windows Authentication with OpenId (OpenIddict)?

Question

I implemented OpenIddict with ASP.NET Identity as a separate auth server and I use the client credentials and password flows. I also have a web api project as the resource server.

The resource server is deployed in IIS and needs to authenticate domain users as well as end users. All controllers have the [Authorize] attribute and the actions have a custom authentication filter inheriting from ActionFilterAttribute with which I check for permissions against the db. The resource server has integrated windows authentication.

Currently at this stage of the development I cannot use ADFS or AAD.

Domain users access the resource server using a Winforms app in which they pass their network credentials. End users have websites and native apps and will/should use password flow to get an access token.

So, my question is:

Should I have an endpoint with [Authorize] in the auth server with which the domain users can authenticate with? In this case I would also need to use integrated windows authentication (which I'd rather like to avoid).

And once the domain user is authenticated, should I use the client credentials flow to acquire an access token? Domain users do not need to be saved in ASP.NET Identity. End users will use password flow.

Is this the correct way to handle both Windows Authenication and OpenId?

question from:https://stackoverflow.com/questions/65869094/what-is-the-correct-way-to-use-windows-authentication-with-openid-openiddict

Answer 1

Waitting for answers