title: Combining token based authentication with Windows Authentication
body: <p>We currently have an internal API that uses Windows Authentication. I've been charged with looking into making this API public, and one of the requirements is that it should be possible to login without a domain user. Domain users should still be able to login, and should be considered super admins (access everything).</p>
  
  <p>It is also clear that before long, we will need role or claim based authorization. As a prototype, I have implemented a system using ASP.NET Identity. Using JWT tokens and Claims based authorization.</p>
  
  <p>But how do I ensure that users authenticated with Windows Authentication can skip the token step and simply use the API directly?</p>