title: What is the correct way to use Windows Authentication with OpenId (OpenIddict)?
body: <p>I implemented OpenIddict with ASP.NET Identity as a separate auth server and I use the client credentials and password flows. I also have a web api project as the resource server.</p>
  <p>The resource server is deployed in IIS and needs to authenticate domain users as well as end users. All controllers have the <code>[Authorize]</code> attribute and the actions have a custom authentication filter inheriting from <code>ActionFilterAttribute</code> with which I check for permissions against the db. The resource server has integrated windows authentication.</p>
  <p>Currently at this stage of the development I cannot use ADFS or AAD.</p>
  <p>Domain users access the resource server using a Winforms app in which they pass their network credentials. End users have websites and native apps and will/should use password flow to get an access token.</p>
  <p>So, my question is:</p>
  <p>Should I have an endpoint with <code>[Authorize]</code> in the auth server with which the domain users can authenticate with? In this case I would also need to use integrated windows authentication (which I'd rather like to avoid).</p>
  <p>And once the domain user is authenticated, should I use the client credentials flow to acquire an access token? Domain users do not need to be saved in ASP.NET Identity. End users will use password flow.</p>
  <p>Is this the correct way to handle both Windows Authenication and OpenId?</p>