Owin and Windows Auth (mvc5) - using Windows auth as a part of login

I'm trying to have a MVC5 webapp which partially uses Windows Auth.

What I mean by that is, it's effectively forms/cookie based auth, but with the requesting user's Windows principal forming a part of their login credentials.

For example, the login page will say, "You have been identified as somedomain\kierenj. Please enter the secret code to log in." If they enter the correct code, the cookie is set and they're logged in.

If Windows auth fails, then the login page would still appear, but be disabled.

I've experimented with a WindowsPrincipalHanlder like this: https://github.com/JabbR/JabbR/blob/master/JabbR/Middleware/WindowsPrincipalHandler.cs

The gist of it is, if I enable Windows Authentication and disabled Anonymous Authentication, then Owin (or presumably the cookie auth part of it) redirects to the login page - which redirects to the login page - it's a redirect loop.

Note I'm using a very simplified Owin setup. UseCookieAuthentication with ApplicationCookie type and a LoginPath specified; then I call SignIn like this from my account controller:

        var claims = new[] {
            new Claim(ClaimTypes.Name, "Username"),
            new Claim(ClaimTypes.Role, "AuthenticatedUser")
        };
        AuthenticationManager.SignIn(new ClaimsIdentity(claims, DefaultAuthenticationTypes.ApplicationCookie));

(Having first checked WindowsIdentity.GetCurrent() for example)

Do I really need to write my own version of the Owin cookie auth middleware? Can I get the source so I can debug/derive?