title: REST API using Windows authentication
body: <p>I am implementing a REST Web API for a service that will be hosted on Windows now (and on Linux in the future). </p>
  
  <p>We are going to support custom credentials + token/refresh token using OAuth 2.0 and OIDC (via Identity Server 4), but we want to support also Windows authentication to allow integration with Active Driectory. </p>
  
  <p>For clients which use windows authentication, is it better to authenticate once and get token/refresh token mechanism (as we do for credentials authentication) or is it better to authenticate each single request? </p>
  
  <p>The latter option might be less performant as it needs to go through the challange every time?</p>