title: ASP.NET Core use Windows authentication when available and user name password when it isn't
body: <p>We have a web site we are developing using ASP.NET Core 5.0 that we want to allow both staff and clients access.</p>
  <p>The staff are on the domain with Active Directory accounts and the clients are not.</p>
  <p>We want to allow staff to be automatically logged in using Windows Active Directory authentication, but have the clients directed to a login page to verify their user name password against our database.</p>
  <p>We have both of these things working, ie if we turn on just Windows authentication for the site staff can automatically be logged in. If we turn on just anonymous authentication, we have a log in page where all users can login with a user name and password.</p>
  <p>The issue is if we turn both Windows authentication and anonymous authentication on we can use custom middleware code which calls</p>
  <pre><code>context.ChallengeAsync(Microsoft.AspNetCore.Server.IISIntegration.IISDefaults.AuthenticationScheme);
  </code></pre>
  <p>to try to do a login with Active Directory, this works well and signs staff in using Active Directory silently, but for clients (ie public users) this will show the browsers login prompt asking for a domain user name password</p>
  <p><a href="https://i.stack.imgur.com/icXNZ.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/icXNZ.png" alt="enter image description here" /></a></p>
  <p>We don't want this to appear for clients at all but rather to redirect them to our login page.</p>
  <p>How can we make the call to ChallengeAsync do an Active Directory login if it can, but if it can't don't show the login prompt but rather just redirect to the login page?</p>