I am in the process of implementing a single page app based on Angular and Node.js, running on a Windows Server within a corporate Windows Active directory domain environmen
Since 2020, it can also be done with node-expose-sspi. This module let you deal with the Microsoft SSPI API which was exposed to Node.
SSO can be done with both Kerberos and NTLM. It has been tested and is in production as intranet ERP.
Note: I am the author of node-expose-sspi.
As the author noted in their update, this can be done with Node-SSPI. I verified that it also works on a windows domain.