title: Is ASP.NET Core Identity needed for Intranet app using Windows Authentication
body: <p>Using Windows Authentication in an Intranet web application I want to achieve the following:</p>
  
  <ul>
  <li>Gather additional attributes from AD (name, employee number)</li>
  <li>Gather additional attributes from a database table (working hours, pay)</li>
  <li>Authorize based on application roles (not AD groups)</li>
  <li>Authorize based on an AD attribute (has direct reports)</li>
  <li>User not provide a username/password</li>
  </ul>
  
  <p>In my search for an answer it is suggested that I need to add <code>ClaimsTransformation</code> to my application:</p>
  
  <p><a href="https://stackoverflow.com/q/39027749/1108740">How do I use Windows Authentication with users in database</a></p>
  
  <p><a href="https://stackoverflow.com/questions/40305299/populate-custom-claim-from-sql-with-windows-authenticated-app-in-net-core">Populate custom claim from SQL with Windows Authenticated app in .Net Core</a></p>
  
  <p><a href="https://stackoverflow.com/questions/46181575/caching-claims-in-net-core-2-0">Caching Claims in .net core 2.0</a></p>
  
  <p>Though I don't fully understand the solution and why <code>ClaimsTransformation</code> happens on every request so I'm looking for answers to the following:</p>
  
  <ol>
  <li>Is ASP.NET Core Identity required for <code>ClaimsTransformation</code> to work?</li>
  <li>Does <code>ClaimsTransformation</code> happen on every request with just Windows Authentication or also with form based authentication?</li>
  <li>Does this have to happen on every request?</li>
  <li>Caching claims like GivenName, Surname seem simple but what about roles? What steps need to be taken to ensure the database isn't hit every time but roles do get updated when there are changes.</li>
  <li>Is there a simpler alternative for what I'm trying to do?</li>
  </ol>