title: Web API (under IIS) Windows Authentication with Bearer Token
body: <p>It's so strange that this simple solution is not yet implemented or is it that I can't Google it ;p)  (I'm trying from last 5 days).
  My requirements: </p>
  
  <ol>
  <li>Call from Angular App (withCredentials = true) on a URL to see if it is windows user (<strong>challenge NTLM</strong>). (I may configure this based on what URL user accessing it). If it's a valid Windows user and I find them in DB, I return the Bearer Token.</li>
  <li>If Above call returns Unauthorised (401), I show login form to user in my AngularJS (1.6) client. User provides non-windows username and password and when user click Login, from angular service go to another URL (for getting Bearer Token  - standard OWIN stuff).</li>
  </ol>
  
  <p>** In any case above, I store Bearer Token in my client for any further API interaction.</p>
  
  <ul>
  <li>I'm not using ASP.NET identity but I have my own DAL to verify user from DB.</li>
  <li>I'm going to have my own custom Authorise (inherited) attribute (which will check for Bearer Token only).</li>
  <li>I don't want users to enter Windows login on my form and to authenticate them from Active Directory.</li>
  <li>I Don't want windows users to click on any separate button to login. (They should just login seamless - with prompt from browser asking them windows login)</li>
  </ul>
  
  <p>I've seen hundreds of posts but nowhere I could see exactly what need. Either the mixed authentication needs to be Cookie based or separate MVC implementation. (Lot's of confusion)
  Already referred:</p>
  
  <ul>
  <li><a href="https://techblog.dorogin.com/mixed-windows-forms-authentication-for-ajax-single-page-application-e4aaaac0424a" rel="nofollow noreferrer">https://techblog.dorogin.com/mixed-windows-forms-authentication-for-ajax-single-page-application-e4aaaac0424a</a></li>
  <li><a href="https://techblog.dorogin.com/mixed-windows-forms-authentication-for-ajax-single-page-application-e4aaaac0424a" rel="nofollow noreferrer">https://techblog.dorogin.com/mixed-windows-forms-authentication-for-ajax-single-page-application-e4aaaac0424a</a></li>
  <li><a href="https://github.com/MohammadYounes/OWIN-MixedAuth" rel="nofollow noreferrer">https://github.com/MohammadYounes/OWIN-MixedAuth</a></li>
  <li>Don't know if this may help: (but again with cookie) <a href="https://github.com/pysco68/Pysco68.Owin.Authentication.Ntlm" rel="nofollow noreferrer">https://github.com/pysco68/Pysco68.Owin.Authentication.Ntlm</a></li>
  </ul>
  
  <p>Can someone please help?</p>
  
  <p>I may have to give up on this by tomorrow evening :-(</p>