If you are using IIS, you can let Active Directory do the authentication based on the windows credentials. ArcGIS Server can use AD for a user store and your services can be accessed based on the authentication/authorization from the store.
<script type="text/javascript">
        dojo.require("dojo.parser");
        dojo.require("esri.IdentityManager");
  var cred = "esri_jsapi_id_manager_data";
  var shortLivedTokenValidity=60;
        function init() {
            var idBase = new esri.IdentityManagerBase();
            esri.config.defaults.io.proxyUrl = "proxy.ashx";
            var serverInfo = {
                "server": "http://myserver:8399",
                "tokenServiceUrl": "http://myserver/arcgis/tokens",
                "currentVersion": 10.4
            };
            var def = idBase.generateToken(serverInfo, { "username": "rahul", "password": "rahul" });
            def.addCallback(function (tokenInfo) {
    var idBase = new esri.IdentityManagerBase();
    //Short lived token is valid for 60 mins by defult 
                idBase.tokenValidity =shortLivedTokenValidity=60;
                var serverInfo = {
                    "server": "http://myserver:8399",
                    "tokenServiceUrl": "http://csslsystem-254:8399/arcgis/tokens",
                    "currentVersion": 10.04
                };
                esri.id.registerServers([serverInfo]);
    //get token creation time in epoch
                var creationTime = (new Date).getTime();
    //calculate the token expiration based on short lived token validity
                var expirationTime = creationTime + (shortLivedTokenValidity * 60000);
    //create array of secured services 
                var securedServices = [];
                for (var services in this.configData.mapService) {
                    securedServices.push(this.configData.mapService[services]);
                }
                var idString = dojo.toJson({ "serverInfos": [serverInfo],
                    "credentials": [{
                        "userId": rahul,
                        "server": "http://myserver:8399",
                        "token": tokenInfo.token,
                        "expires": expirationTime,
                        "ssl": false,
                        "creationTime": creationTime,
                        "resources": securedServices
                    }]
                });
                // store it client side
                if (_supports_local_storage()) {
                    // use local storage
                    window.localStorage.setItem(this._jsAPIIDManagerData, idString);
                } else {
                    // use a cookie
                    dojo.cookie(this._jsAPIIDManagerData, idString, { expires: 1 });
                }
                this._loadCredentials();
    
   });
   
               
        }
  
   function _supports_local_storage() {
            try {
                return "localStorage" in window && window["localStorage"] !== null;
            } catch (e) {
                return false;
            }
        }
        function _loadCredentials() {
            var idJson, idObject;
            if (this._supports_local_storage()) {
                // read from local storage
                idJson = window.localStorage.getItem(this._jsAPIIDManagerData);
            } else {
                // read from a cookie
                idJson = dojo.cookie(this._jsAPIIDManagerData);
            }
            if (idJson && idJson != "null" && idJson.length > 4) {
                idObject = dojo.fromJson(idJson);
                esri.id.initialize(idObject);
            }
        }
        dojo.addOnLoad(init);
    </script>var getToken = function(onComplete){
  dojo.xhrGet({
    url: this.basePath + "code/getFwpTokenNew.jsp?ref=" + document.location.protocol + "%2F%2F" + document.location.hostname,
    handleAs: "text",
    load: function(data){
      var jsonData = dojo.fromJson(data);
      onComplete(jsonData.token);
    },
    error: function(error){
      console.debug(error);
    }
  });
};
<%@page session="false"%>
<%@page import="java.net.*,java.io.*" %> 
 
<% 
response.setHeader("Cache-Control","no-cache"); //HTTP 1.1
response.setHeader("Pragma","no-cache"); //HTTP 1.0
response.setDateHeader ("Expires", 0); //prevents caching at the proxy server
String onErrorText = "";
try {
  
  String reqUrl = request.getQueryString();
  String onProd = request.getParameter("prodServer");
  String refUrl = request.getParameter("ref");
  String agsServerUserName = "username";
  String agsServerPswd = "password";
  String agsServerPath = "http://yourserverpath";
  out.clear();
        
  String getTokenUrl = agsServerPath +"/arcgis/tokens/gettoken?request=getToken&username="+agsServerUserName+"&password="+agsServerPswd+"&clientid=ref."+refUrl+"&expiration=1440";
  URL tokenRequest = new URL(getTokenUrl);
  BufferedReader in1 = new BufferedReader(new InputStreamReader(tokenRequest.openStream()));
  String token = in1.readLine();  
  in1.close();
  out.println("{'token':'"+token+"'}");
  return;
  
} 
catch(Exception e) {
  out.println("{'error':'There was retrieving the token for the map server.'}");
}
%>
					
				
			
			
				
			
			
				
			
			
			
			
			
			
		