# Okta Api Authorization with Windows Active Directory fallback

**URL:** <https://devforum.okta.com/t/okta-api-authorization-with-windows-active-directory-fallback/8791>\
**Category:** Questions\
**Created:** [April 7, 2020, 3:37pm UTC](https://devforum.okta.com/t/okta-api-authorization-with-windows-active-directory-fallback/8791 "2020-04-07T15:37:35Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![slbentley](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@slbentley](https://devforum.okta.com/u/slbentley)\
**Post date:** [April 7, 2020, 3:37pm UTC](https://devforum.okta.com/t/okta-api-authorization-with-windows-active-directory-fallback/8791/1 "2020-04-07T15:37:35Z")

</div>

I’m attempting to setup authorizations in a new .net core 3.1 api using Okta. Using the quick start it looks pretty simple using  
services.AddAuthentication(options =\>  
{  
options.DefaultChallengeScheme=OktaDefaults.ApiAuthenticationScheme  
etc etc.

But, I have some legacy apps that will not be authenticating against Okta. For those I would like to fall back to active directory groups for authorization. Is this possible using the code above? Looks like that code is setting the one default to rule them all. Not sure how I would tackle an either/or approach.

---

<div class="post-metadata">

**Author:** ![slbentley](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@slbentley](https://devforum.okta.com/u/slbentley)\
**Post date:** [April 7, 2020, 4:02pm UTC](https://devforum.okta.com/t/okta-api-authorization-with-windows-active-directory-fallback/8791/2 "2020-04-07T16:02:36Z")

</div>

Wait would it just be something like this…  
services.AddAuthentication(IISDefaults.AuthenticationScheme) //Windows  
.AddOktaWebApi(new OktaWebApiOptions() //Okta  
{  
OktaDomain = “https://[mydomain].okta.com”,  
});

---

<div class="post-metadata">

**Author:** ![slbentley](https://avatars.discourse-cdn.com/v4/letter/s/ce73a5/32.png) [@slbentley](https://devforum.okta.com/u/slbentley)\
**Post date:** [April 14, 2020, 2:46pm UTC](https://devforum.okta.com/t/okta-api-authorization-with-windows-active-directory-fallback/8791/3 "2020-04-14T14:46:51Z")

</div>

For the record, this did work, for anyone wanting to do something similar.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/oktadev/original/1X/589c4c5f80de422d01f47cee7185a7fb8227835c.png) [@system](https://devforum.okta.com/u/system)\
**Post date:** [January 24, 2024, 7:10pm UTC](https://devforum.okta.com/t/okta-api-authorization-with-windows-active-directory-fallback/8791/4 "2024-01-24T19:10:27Z")

</div>

This topic was automatically closed 24 hours after the last reply. New replies are no longer allowed.