We have a web solution (running in IIS) where AD users and non-AD users need to log into. We sell this to companies and will run this on-prem only.
non-AD-FS and only AD question (so no federation)
I asked on stackoverflow if it is valid to pass the username and password to the web application and have the application logon in their behalf versus using Windows authentication enabled sites. Where of course the credentials are never stored or logged etc. here: https://stackoverflow.com/questions/63047112/is-it-wrong-to-send-active-directory-credentials-of-a-user-to-a-backend-system/63055942#63055942
At first this seemed a very bad idea which was my initial reaction. But it seems it is an acceptable pattern.
Will security officers (CSO) in companies, in general, accept this or not for a 3rd party solution installed on prem? Because the risk is that it is implemented in this way and CSO or static security code analyses will later on whistle.