Hi everyone! I have been developing with asp.net for almost 3 years. In that time I've always been able to pass off authentication and authorization to windows by using Windows auth and impersonation.

I now face a project where this isn't feasible. I am so confused by the documentation here https://docs.microsoft.com/en-us/aspnet/core/security/ .

It seems like the docs hound after a particular use case and it isn't mine.

Here's my scenario: One webapi supporting three web apps all need to authenticate with the same credentials. This has to happen in intranet and so I can't rely on cloud auth.

Any advice on what to read / what I'm missing?

Thanks!