I have just installed Visual Studio 2013, created an MVC Web Application project and noticed a new file in the project template called Startup.cs.

What is this, how is this different from Global.asax.cs and are there any good best practices on what to use this for?

What is the new Startup.cs file for in Visual Studio 2013 projects?

I am a newbie in ASP.NET, and currently learning ASP.NET Identity. I know it&#39;s built on top of OWIN implementation by Microsoft, and I am also still learning that too. So, I came across the extension method CreatePerOwinContext in the Owin startup code, and I don&#39;t see a clear purpose of using it. Is it some kind of dependency injection container? What is the real purpose of the method? In what case it should be applied?

What is the purpose of the extension method CreatePerOwinContext in OWIN implementation by Microsoft

The project was running fine until I updated all NuGet packages via 
NuGet Manager (I was trying to get the latest OWIN packages).

This error is in the `_Layout.cshtml` and I have not touched it at all.

&gt; Object reference not set to an instance of an object.
&gt; 
&gt; Description: An unhandled exception occurred during the execution of
&gt; the current web request. Please review the stack trace for more
&gt; information about the error and where it originated in the code. 
&gt; 
&gt; Exception Details: `System.NullReferenceException`: Object reference not
&gt; set to an instance of an object.
&gt; 
&gt; Source Error: 
&gt; 
&gt; 
&gt;     Line 13:  
&gt;     Line 14:     &lt;!-- Custom Fonts --&gt;
&gt;     Line 15:     @Scripts.Render(&quot;~/Content/fonts&quot;)
&gt; 
&gt; Source File: f:\Workplace\lrc\lrc\Views\Shared\_Layout.cshtml    Line:
&gt; 15

---------------------------------

### Update

Here is the code in the `_Layout.cshtml` (they are automatically generated when creating the project):

&lt;!-- language: lang-html --&gt;
    &lt;!DOCTYPE html&gt;
    &lt;html&gt;
    &lt;head&gt;
        &lt;meta charset=&quot;utf-8&quot; /&gt;
        &lt;meta http-equiv=&quot;X-UA-Compatible&quot; content=&quot;IE=edge&quot;&gt;
        &lt;meta name=&quot;viewport&quot; content=&quot;width=device-width, initial-scale=1.0&quot;&gt;
        &lt;meta name=&quot;description&quot; content=&quot;LRC - We are aiming at building up a healthier life style.&quot;&gt;
        &lt;meta name=&quot;author&quot; content=&quot;Winston Fan&quot;&gt;
        &lt;title&gt;@ViewBag.Title - LRC&lt;/title&gt;
        @Styles.Render(&quot;~/Content/css&quot;)
        @Scripts.Render(&quot;~/bundles/modernizr&quot;)
    
        &lt;!-- Custom Fonts --&gt;
        @Scripts.Render(&quot;~/Content/fonts&quot;)
        
        &lt;link href=&quot;http://fonts.googleapis.com/css?family=Lora:400,700,400italic,700italic&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt;
        &lt;link href=&quot;http://fonts.googleapis.com/css?family=Montserrat:400,700&quot; rel=&quot;stylesheet&quot; type=&quot;text/css&quot;&gt;

So it is complaining this line of code:

    @Scripts.Render(&quot;~/Content/fonts&quot;)

But as you can see that, this is VS generated code, how could I make it wrong?

I also checked the content in the `Conntent/font-awesome/fonts` folder and all required resources are there. 

Here is the code inside the `BundleConfig` (which is also the auto-generated code):

&lt;!-- language: lang-csharp --&gt;
    bundles.Add(new ScriptBundle(&quot;~/Content/fonts&quot;).Include(
                  &quot;~/Content/font-awesome/fonts/fontawesome-*&quot;,
                  &quot;~/Content/font-awesome/fonts/FontAwesome.otf&quot;));

My `Microsoft.OWin.Security`, `Microsoft.OWin.Security.Google` and `Microsoft.OWin` are version `3.0.1.0`.

-----------------------------------------------------

### Update 2

Here is the stack trace:

&gt;     [NullReferenceException: Object reference not set to an instance of an
&gt;     object.]    Microsoft.Ajax.Utilities.JSParser.ParseExpression(AstNode
&gt;     leftHandSide, Boolean single, Boolean bCanAssign, JSToken inToken)
&gt;     +1007    Microsoft.Ajax.Utilities.JSParser.ParseExpressionStatement(Boolean
&gt;     fSourceElement) +268   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseStatement(Boolean
&gt;     fSourceElement, Boolean skipImportantComment) +1552   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseBlock() +164   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseStatement(Boolean
&gt;     fSourceElement, Boolean skipImportantComment) +498   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseBlock() +164   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseStatement(Boolean
&gt;     fSourceElement, Boolean skipImportantComment) +498   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseBlock() +164   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseStatement(Boolean
&gt;     fSourceElement, Boolean skipImportantComment) +498   
&gt;     Microsoft.Ajax.Utilities.JSParser.ParseStatements(Block block) +159   
&gt;     Microsoft.Ajax.Utilities.JSParser.InternalParse() +1011   
&gt;     Microsoft.Ajax.Utilities.JSParser.Parse(DocumentContext sourceContext)
&gt;     +123    Microsoft.Ajax.Utilities.JSParser.Parse(DocumentContext sourceContext, CodeSettings settings) +54   
&gt;     Microsoft.Ajax.Utilities.Minifier.MinifyJavaScript(String source,
&gt;     CodeSettings codeSettings) +987   
&gt;     System.Web.Optimization.JsMinify.Process(BundleContext context,
&gt;     BundleResponse response) +310   
&gt;     System.Web.Optimization.Bundle.ApplyTransforms(BundleContext context,
&gt;     String bundleContent, IEnumerable`1 bundleFiles) +263   
&gt;     System.Web.Optimization.Bundle.GenerateBundleResponse(BundleContext
&gt;     context) +355   
&gt;     System.Web.Optimization.Bundle.GetBundleResponse(BundleContext
&gt;     context) +104   
&gt;     System.Web.Optimization.BundleResolver.GetBundleContents(String
&gt;     virtualPath) +254   
&gt;     System.Web.Optimization.AssetManager.DeterminePathsToRender(IEnumerable`1
&gt;     assets) +252   
&gt;     System.Web.Optimization.AssetManager.RenderExplicit(String tagFormat,
&gt;     String[] paths) +75   
&gt;     System.Web.Optimization.Scripts.RenderFormat(String tagFormat,
&gt;     String[] paths) +292   
&gt;     System.Web.Optimization.Scripts.Render(String[] paths) +51   
&gt;     ASP._Page_Views_Shared__Layout_cshtml.Execute() in
&gt;     f:\Workplace\lrc\lrc\Views\Shared\_Layout.cshtml:15   
&gt;     System.Web.WebPages.WebPageBase.ExecutePageHierarchy() +271   
&gt;     System.Web.Mvc.WebViewPage.ExecutePageHierarchy() +121   
&gt;     System.Web.WebPages.WebPageBase.ExecutePageHierarchy(WebPageContext
&gt;     pageContext, TextWriter writer, WebPageRenderingBase startPage) +145  
&gt;     System.Web.WebPages.WebPageBase.ExecutePageHierarchy(WebPageContext
&gt;     pageContext, TextWriter writer) +41   
&gt;     System.Web.WebPages.&lt;&gt;c__DisplayClass3.&lt;RenderPageCore&gt;b__2(TextWriter
&gt;     writer) +335    System.Web.WebPages.HelperResult.WriteTo(TextWriter
&gt;     writer) +42   
&gt;     System.Web.WebPages.WebPageExecutingBase.WriteTo(TextWriter writer,
&gt;     HelperResult content) +45   
&gt;     System.Web.WebPages.WebPageBase.Write(HelperResult result) +53   
&gt;     System.Web.WebPages.WebPageBase.RenderSurrounding(String
&gt;     partialViewName, Action`1 body) +178   
&gt;     System.Web.WebPages.WebPageBase.PopContext() +229   
&gt;     System.Web.WebPages.WebPageBase.ExecutePageHierarchy(WebPageContext
&gt;     pageContext, TextWriter writer, WebPageRenderingBase startPage) +154  
&gt;     System.Web.Mvc.RazorView.RenderView(ViewContext viewContext,
&gt;     TextWriter writer, Object instance) +695   
&gt;     System.Web.Mvc.BuildManagerCompiledView.Render(ViewContext
&gt;     viewContext, TextWriter writer) +382   
&gt;     System.Web.Mvc.ViewResultBase.ExecuteResult(ControllerContext context)
&gt;     +431    System.Web.Mvc.ControllerActionInvoker.InvokeActionResult(ControllerContext
&gt;     controllerContext, ActionResult actionResult) +39   
&gt;     System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1
&gt;     filters, Int32 filterIndex, ResultExecutingContext preContext,
&gt;     ControllerContext controllerContext, ActionResult actionResult) +116  
&gt;     System.Web.Mvc.ControllerActionInvoker.InvokeActionResultFilterRecursive(IList`1
&gt;     filters, Int32 filterIndex, ResultExecutingContext preContext,
&gt;     ControllerContext controllerContext, ActionResult actionResult) +529  
&gt;     System.Web.Mvc.ControllerActionInvoker.InvokeActionResultWithFilters(ControllerContext
&gt;     controllerContext, IList`1 filters, ActionResult actionResult) +106   
&gt;     System.Web.Mvc.Async.&lt;&gt;c__DisplayClass2b.&lt;BeginInvokeAction&gt;b__1c()
&gt;     +321    System.Web.Mvc.Async.&lt;&gt;c__DisplayClass21.&lt;BeginInvokeAction&gt;b__1e(IAsyncResult
&gt;     asyncResult) +185   
&gt;     System.Web.Mvc.Async.WrappedAsyncResult`1.CallEndDelegate(IAsyncResult
&gt;     asyncResult) +42   
&gt;     System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +133   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +56   
&gt;     System.Web.Mvc.Async.AsyncControllerActionInvoker.EndInvokeAction(IAsyncResult
&gt;     asyncResult) +40   
&gt;     System.Web.Mvc.Controller.&lt;BeginExecuteCore&gt;b__1d(IAsyncResult
&gt;     asyncResult, ExecuteCoreState innerState) +34   
&gt;     System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult
&gt;     asyncResult) +70   
&gt;     System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +139   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +59   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +40   
&gt;     System.Web.Mvc.Controller.EndExecuteCore(IAsyncResult asyncResult) +44
&gt;     System.Web.Mvc.Controller.&lt;BeginExecute&gt;b__15(IAsyncResult
&gt;     asyncResult, Controller controller) +39   
&gt;     System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult
&gt;     asyncResult) +62   
&gt;     System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +139   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +59   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +40    System.Web.Mvc.Controller.EndExecute(IAsyncResult
&gt;     asyncResult) +39   
&gt;     System.Web.Mvc.Controller.System.Web.Mvc.Async.IAsyncController.EndExecute(IAsyncResult
&gt;     asyncResult) +39   
&gt;     System.Web.Mvc.MvcHandler.&lt;BeginProcessRequest&gt;b__5(IAsyncResult
&gt;     asyncResult, ProcessRequestState innerState) +39   
&gt;     System.Web.Mvc.Async.WrappedAsyncVoid`1.CallEndDelegate(IAsyncResult
&gt;     asyncResult) +70   
&gt;     System.Web.Mvc.Async.WrappedAsyncResultBase`1.End() +139   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +59   
&gt;     System.Web.Mvc.Async.AsyncResultWrapper.End(IAsyncResult asyncResult,
&gt;     Object tag) +40   
&gt;     System.Web.Mvc.MvcHandler.EndProcessRequest(IAsyncResult asyncResult)
&gt;     +40    System.Web.Mvc.MvcHandler.System.Web.IHttpAsyncHandler.EndProcessRequest(IAsyncResult
&gt;     result) +38   
&gt;     System.Web.CallHandlerExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
&gt;     +932    System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously) +188

----------------------------------------

### Update 3

Here is the `Content` folder:

![enter image description here][1]

-------------------------------

### Update 4

Here is the content of the `packages.config`:

&lt;!-- language: lang-xml --&gt;
    &lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
    &lt;packages&gt;
      &lt;package id=&quot;Antlr&quot; version=&quot;3.5.0.2&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;bootstrap&quot; version=&quot;3.3.4&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;EntityFramework&quot; version=&quot;6.1.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;jQuery&quot; version=&quot;2.1.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;jQuery.Validation&quot; version=&quot;1.13.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.Identity.Core&quot; version=&quot;2.2.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.Identity.EntityFramework&quot; version=&quot;2.2.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.Identity.Owin&quot; version=&quot;2.2.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.Mvc&quot; version=&quot;5.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.Razor&quot; version=&quot;3.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.Web.Optimization&quot; version=&quot;1.1.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.WebApi&quot; version=&quot;5.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.WebApi.Client&quot; version=&quot;5.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.WebApi.Core&quot; version=&quot;5.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.WebApi.WebHost&quot; version=&quot;5.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.AspNet.WebPages&quot; version=&quot;3.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.jQuery.Unobtrusive.Validation&quot; version=&quot;3.2.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Host.SystemWeb&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security.Cookies&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security.Facebook&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security.Google&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security.MicrosoftAccount&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security.OAuth&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Owin.Security.Twitter&quot; version=&quot;3.0.1&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Microsoft.Web.Infrastructure&quot; version=&quot;1.0.0.0&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Modernizr&quot; version=&quot;2.8.3&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Newtonsoft.Json&quot; version=&quot;6.0.8&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Owin&quot; version=&quot;1.0&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;Respond&quot; version=&quot;1.4.2&quot; targetFramework=&quot;net451&quot; /&gt;
      &lt;package id=&quot;WebGrease&quot; version=&quot;1.6.0&quot; targetFramework=&quot;net451&quot; /&gt;
    &lt;/packages&gt;

  [1]: http://i.stack.imgur.com/lciDc.png

Object reference not set to an instance of an object in _Layout.cshtml after updated packages

This is driving me insane. 

I&#39;m using latest signalR release (2.0.2). This is my hub code (OnConnected)

            public override Task OnConnected()
            {
                //User is null then Identity and Name too.
                Connections.Add(Context.User.Identity.Name, Context.ConnectionId);
                return base.OnConnected();
            }

And this is my Controller&#39;s login method:

   

            [HttpPost]
            [AllowAnonymous]
            [ValidateAntiForgeryToken]
            public async Task&lt;ActionResult&gt; Login(LoginViewModel model, string returnUrl)
            {
                if (ModelState.IsValid)
                {
                  var user = await UnitOfWork.UserRepository.FindAsync(model.UserName,  model.Password);
                    
                    if (user != null)
                    {
                        await SignInAsync(user, model.RememberMe);
    
                        return RedirectToLocal(returnUrl);
                    }
                }
    
                TempData[&quot;ErrorMessage&quot;] = Resources.InvalidUserNameOrPassword;
    
                // If we got this far, something failed, redisplay form
                return RedirectToAction(&quot;Index&quot;,&quot;Home&quot;);
            }


I found that some people are having this issue on OnDisconnected, I don&#39;t even make it there.

I&#39;m using MCV5 template.

Do you have any idea what is wrong?


Context.User.Identity.Name is null with SignalR 2.X.X. How to fix it?

Is it possible for a self-hosted OWIN Web API to run under a non-administrator account?  I have already tried dozens of url reservations and nothing works.  The service fails to start with &quot;Access is denied&quot;. It works when the account is added to the administrator role but I don&#39;t want that.  Code below is running on Win 7 framework 4.5.2.  

    //install-package microsoft.owin.hosting
    //install-package Microsoft.Owin.Host.HttpListener
    
    StartOptions options = new StartOptions();
    options.Urls.Add(&quot;http://localhost:5000/&quot;);
    //options.Urls.Add(string.Format(&quot;http://{0}:5000&quot;, Environment.MachineName));
    //options.Urls.Add(&quot;http://+:5000/&quot;);
    //options.Urls.Add(&quot;http://*:5000/&quot;);
    
    using (WebApp.Start&lt;WebAPISelfHostMinimal.Startup&gt;(options))
    {
        while (!Terminate)
        {
            await Task.Delay(10); //keep cpu from getting pegged
        }
    
        LogUtil.LogInfo(&quot;Terminating owin host.&quot;);
    }

**EDIT** - this is running under a Windows account.

    C:\&gt;netsh http add urlacl http://+:5000/ user=mini2012\svcAPI
    
    URL reservation successfully added
    
    C:\&gt;sc start apiservice
    [SC] StartService FAILED 5:
    
    Access is denied.
    
    C:\&gt;netsh http add urlacl http://*:5000/ user=mini2012\svcAPI
    
    URL reservation successfully added
    
    C:\&gt;sc start apiservice
    [SC] StartService FAILED 5:
    
    Access is denied.
    
    C:\&gt;netsh http add urlacl http://localhost:5000/ user=mini2012\svcAPI
    
    URL reservation successfully added
    
    C:\&gt;sc start apiservice
    [SC] StartService FAILED 5:
    
    Access is denied.



Running self-hosted OWIN Web API under non-admin account

I use Owin to authorize through Google oAuth. Here is how my cookies are configured:

    // Enable the application to use a cookie to store information for the signed in user
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        LoginPath = new PathString(&quot;/Authentication/Login&quot;)
    });
    // Use a cookie to temporarily store information about a user logging in with a third party login provider
    app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

So am using both UseCookieAuthentication and UseExternalSignInCookie and it seems redundant. Which of these two AuthenticationTypes should I specify for IAuthenticationManager methods (SignIn, SingOUt, etc.)? Or should I keep just one of them?

**Update.** What confuses me most is SignIn method:

    private async Task SignInAsync(ApplicationUser user, bool isPersistent)
    {
        AuthenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);
        var identity = await UserManager.CreateIdentityAsync(user, DefaultAuthenticationTypes.ApplicationCookie);
        AuthenticationManager.SignIn(new AuthenticationProperties() { IsPersistent = isPersistent }, identity);
    }

So signsout from ExternalCookie, but signs in ApplicationCookie.

UseCookieAuthentication vs. UseExternalSignInCookie

I have a rather strange issue i&#39;m not sure how to fix or if i can even fix it.

I&#39;ve done some research into the issue but can&#39;t find an answer to what&#39;s causing it.

I&#39;m following a rather simple guide at http://www.asp.net/mvc/tutorials/mvc-5/create-an-aspnet-mvc-5-app-with-facebook-and-google-oauth2-and-openid-sign-on

and after enabling **`SSL`** and changing the **`controller`** to require https i get the following error:

&gt; Server Error in &#39;/&#39; Application.
&gt; 
&gt; Object reference not set to an instance of an object.
&gt; 
&gt; Description: An unhandled exception occurred during the execution of
&gt; the current web request. Please review the stack trace for more
&gt; information about the error and where it originated in the code. 
&gt; 
&gt; Exception Details: System.NullReferenceException: Object reference not
&gt; set to an instance of an object.
&gt; 
&gt; Source Error: 
&gt; 
&gt; An unhandled exception was generated during the execution of the
&gt; current web request. Information regarding the origin and location of
&gt; the exception can be identified using the exception stack trace below.
&gt; 
&gt; Stack Trace: 
&gt; 
&gt; 
&gt; [NullReferenceException: Object reference not set to an instance of an
&gt; object.]   
&gt; Microsoft.Owin.Security.Cookies.CookieAuthenticationProvider.Exception(CookieExceptionContext
&gt; context) +49   
&gt; Microsoft.Owin.Security.Cookies.&lt;AuthenticateCoreAsync&gt;d__2.MoveNext()
&gt; +3698    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()
&gt; +24    Microsoft.Owin.Security.Infrastructure.&lt;BaseInitializeAsync&gt;d__0.MoveNext()
&gt; +810    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter.GetResult()
&gt; +21    Microsoft.Owin.Security.Infrastructure.&lt;Invoke&gt;d__0.MoveNext() +427    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter.GetResult()
&gt; +21    Microsoft.AspNet.Identity.Owin.&lt;Invoke&gt;d__0.MoveNext() +641    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter.GetResult()
&gt; +21    Microsoft.AspNet.Identity.Owin.&lt;Invoke&gt;d__0.MoveNext() +641    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter.GetResult()
&gt; +21    Microsoft.AspNet.Identity.Owin.&lt;Invoke&gt;d__0.MoveNext() +641    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter.GetResult()
&gt; +21    Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.&lt;RunApp&gt;d__5.MoveNext()
&gt; +287    System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task
&gt; task) +93   
&gt; System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task
&gt; task) +52    System.Runtime.CompilerServices.TaskAwaiter.GetResult()
&gt; +21    Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.&lt;DoFinalWork&gt;d__2.MoveNext()
&gt; +272    System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw() +22    Microsoft.Owin.Host.SystemWeb.Infrastructure.ErrorState.Rethrow() +33 
&gt; Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.StageAsyncResult.End(IAsyncResult
&gt; ar) +150   
&gt; Microsoft.Owin.Host.SystemWeb.IntegratedPipeline.IntegratedPipelineContext.EndFinalWork(IAsyncResult
&gt; ar) +42   
&gt; System.Web.AsyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
&gt; +415    System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean&amp; completedSynchronously) +155
&gt; 
&gt; Version Information: Microsoft .NET Framework Version:4.0.30319;
&gt; ASP.NET Version:4.0.30319.34237

Turning off `SSL` fixes the issue, I also know that commenting out the **`startup.auth`** in `app_start` fixes the issue on `SSL`.

**Does anyone know why this is happening?**

Why is [Owin] throwing a null exception on new project?

I&#39;m trying to develop a web api self hosting app using OWIN.
In my own XyzStartup class, I need an external argument: contentFolderPath.

However, I didn&#39;t find a way to pass this argument. Here is my code below:


    var contentFolderPath = this.TextBox.Text; // user input

    var startOptions = new StartOptions();
    using(WebApp.Start&lt;XyzStartup&gt;(startOptions)){
    
    }


My startup

    public class XyzStartup
    {
         XyzStartup(string contentFolderPath) {  ...  }
    }

I noticed there is a StartOption class, but don&#39;t how to use it. Can I use it in my XyzStartup class?

Thanks in advance!

-----------------
I finally find a way to do this:

    var startOptions = new StartOptions();
    startOptions.Urls.Add(&#39;..some url ..&#39;);
    
    WebApp.Start(startOptions, (appBuilder)=&gt;{
        new XyzStartup(contentFolderPath).Configuration(appBuilder);
    }



Hw to pass arguments to my own Startup class?

In our `Startup` class, I have configured the following auth server options:

    OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
    {
        AllowInsecureHttp = true,
        TokenEndpointPath = new PathString(&quot;/api/v1/token&quot;),
        AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
        Provider = new SimpleAuthorizationServerProvider()
    };

After this, which option are we supposed to use to actually enable bearer authentication?  There seem to be two variations on the Internet.

**Option 1:**

    app.UseOAuthAuthorizationServer(OAuthServerOptions);
    app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

**Option 2:**

    app.UseOAuthBearerTokens(OAuthServerOptions);

I have tested them both and the results are the same.

What are the difference between these options?  When are we supposed to use which?

UseOAuthBearerTokens vs UseOAuthBearerAuthentication

I am new to OWIN and Katana. I really don&#39;t get why I should use OWIN, while I can use `IIS`. To simplify, my question is: What do I lose if I skip learning OWIN and use IIS for my websites?

I googled but there is not a simple explanation. There is some information [here][1], but they use some jargon phrases so I cannot understand it.


  [1]: https://stackoverflow.com/questions/18058799/owin-and-katana-why-decouple-the-application-from-the-server

When should I use OWIN Katana?

I&#39;m getting this error as my project is not able to find the reference for `OWIN` startup class. I&#39;ve even installed all the OWIN reference packages through Nuget still getting the same issue. I&#39;m using `Visual Studio 2012` and `MVC4`. 

The following errors occurred while attempting to load the app.

&gt; - No assembly found containing an OwinStartupAttribute.
&gt; - No assembly found containing a Startup or [AssemblyName].Startup class. To disable OWIN startup discovery, add the appSetting
&gt; owin:AutomaticAppStartup with a value of &quot;false&quot; in your web.config.
&gt; To specify the OWIN startup Assembly, Class, or Method, add the
&gt; appSetting owin:AppStartup with the fully qualified startup class or
&gt; configuration method name in your web.config.

OWIN Startup Class Missing

Let&#39;s say for example in a brand new ASP.NET MVC 5 application made from the MVC with Individual Accounts template, if I delete the `Global.asax.cs` class and move it&#39;s configuration code to `Startup.cs` `Configuration()` method as follow, what are the downsides?


    public partial class Startup
    {
         public void Configuration(IAppBuilder app)
         {
            AreaRegistration.RegisterAllAreas();
            FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
            RouteConfig.RegisterRoutes(RouteTable.Routes);
            BundleConfig.RegisterBundles(BundleTable.Bundles);

            ConfigureAuth(app);
        }
    }

The upsides for me is that when upgrading ASP.NET 4 applications to ASP.NET 5 and using pieces that now must be configured in the Startup.cs class, I&#39;m not doing dependency injection and other configuration in two different classes that seem related to starting up, and configuration.

Do I need a Global.asax.cs file at all if I&#39;m using an OWIN Startup.cs class and move all configuration there?

How do I configure my mvc/webapi project so that a webapi method called from a razor view doesn&#39;t return the loginpage when its unauthorised?

Its a MVC5 application which also has WebApi controllers for calls via javascript.

The two methods below

    [Route(&quot;api/home/LatestProblems&quot;)]      
    [HttpGet()]
    public List&lt;vmLatestProblems&gt; LatestProblems()
    {
        // Something here
    }

    [Route(&quot;api/home/myLatestProblems&quot;)]
    [HttpGet()]
    [Authorize(Roles = &quot;Member&quot;)]
    public List&lt;vmLatestProblems&gt; mylatestproblems()
    {
       // Something there
    }

are called via the following angular code:

    angular.module(&#39;appWorship&#39;).controller(&#39;latest&#39;, 
        [&#39;$scope&#39;, &#39;$http&#39;, function ($scope,$http) {         
            var urlBase = baseurl + &#39;/api/home/LatestProblems&#39;;
            $http.get(urlBase).success(function (data) {
                $scope.data = data;
            }).error(function (data) {
                console.log(data);
            });
            $http.get(baseurl + &#39;/api/home/mylatestproblems&#39;)
              .success(function (data) {
                $scope.data2 = data;
            }).error(function (data) {
                console.log(data);
            });  
        }]
    );

So I&#39;m not logged in and the first method successfully returns data. the second method returns (in the success function) data which contains the equivalent of a login page. i.e. what you would get in mvc if you requested a controller action which was stamped with [Authorize] and you weren&#39;t logged in.

I want it to return a 401 unauthorized, so that i can display different data for users based on if they are logged in or not.  Ideally if the user is logged in i want to be able to access the Controller&#39;s User property so i can return data specific to that Member.


**UPDATE: Since none of the suggestions below seem to work anymore (changes to Identity or WebAPI) ive created a raw example on [github][1] which should illustrate the problem.**


  [1]: https://github.com/tbertenshaw/MVCAPI

Unauthorised webapi call returning login page rather than 401

I have seen lots of similar pages on the web, but most of them use a new project instead of an existing one, or don&#39;t have the necessary features. So, I have an existing `MVC 5` project and want to integrate **ASP.NET MVC5 Identity with log in, email confirmation and password reset** features.

In addition to this, I also need to create all the **necessary tables** on the database i.e. User, Roles, groups, etc. (I use EF Code First in my project). Is there an article or sample that corresponds to these needs?

Adding ASP.NET MVC5 Identity Authentication to an existing project

I have a strange problem with using Owin cookie authentication.

When I start my IIS server authentication works perfectly fine on IE/Firefox and Chrome.

I started doing some testing with Authentication and logging in on different platforms and I have come up with a strange error. Sporadically the Owin framework / IIS just doesn&#39;t send any cookies to the browsers. I will type in a username and password which is correct the code runs but no cookie gets delivered to the browser at all. If I restart the server it starts working then at some point I will try login and again cookies stop getting delivered. Stepping over the code does nothing and throws no errors.

     app.UseCookieAuthentication(new CookieAuthenticationOptions
            {
                AuthenticationMode = AuthenticationMode.Active,
                CookieHttpOnly = true,
                AuthenticationType = &quot;ABC&quot;,
                LoginPath = new PathString(&quot;/Account/Login&quot;),
                CookiePath = &quot;/&quot;,
                CookieName = &quot;ABC&quot;,
                Provider = new CookieAuthenticationProvider
                   {
                      OnApplyRedirect = ctx =&gt;
                      {
                         if (!IsAjaxRequest(ctx.Request))
                         {
                            ctx.Response.Redirect(ctx.RedirectUri);
                         }
                     }
                   }
            });

**And within my login procedure I have the following code:**

    IAuthenticationManager authenticationManager = HttpContext.Current.GetOwinContext().Authentication;
                                authenticationManager.SignOut(DefaultAuthenticationTypes.ExternalCookie);

    var authentication = HttpContext.Current.GetOwinContext().Authentication;
    var identity = new ClaimsIdentity(&quot;ABC&quot;);
    identity.AddClaim(new Claim(ClaimTypes.Name, user.Username));
    identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.User_ID.ToString()));
    identity.AddClaim(new Claim(ClaimTypes.Role, role.myRole.ToString()));
		authentication.AuthenticationResponseGrant =
			new AuthenticationResponseGrant(identity, new AuthenticationProperties()
													   {
														   IsPersistent = isPersistent
													   });
    
    authenticationManager.SignIn(new AuthenticationProperties() {IsPersistent = isPersistent}, identity);


**Update 1:** It seems that one cause of the problem is when I add items to session the problems start. Adding something simple like `Session.Content[&quot;ABC&quot;]= 123` seems to create the problem.

What I can make out is as follows:
1) (Chrome)When I login I get ASP.NET_SessionId + my authentication cookie. 
2) I go to a page that sets a session.contents...
3) Open a new browser (Firefox) and try login and it does not receive an ASP.NET_SessionId nor does it get a Authentication Cookie
4) Whilst the first browser has the ASP.NET_SessionId it continues to work. The minute I remove this cookie it has the same problem as all the other browsers
I am working on ip address (10.x.x.x) and localhost.

**Update 2:** Force creation of `ASPNET_SessionId` first on my login_load page before authentication with OWIN. 

1) before I authenticate with OWIN I make a random `Session.Content` value on my login page to start the ASP.NET_SessionId
2) then I authenticate and make further sessions
3) Other browsers seem to now work

This is bizarre. I can only conclude that this has something to do with ASP and OWIN thinking they are in different domains or something like that.

**Update 3** - Strange behaviour between the two.

Additional strange behaviour identified - Timeout of Owin and ASP session is different. What I am seeing is that my Owin sessions are staying alive longer than my ASP sessions through some mechanism. So when logging in:
1.) I have a cookied based auth session
2.) I set a few session variables

My session variables(2) &quot;die&quot; before the owin cookie session variable forces re-login, which causes unexpected behaviour throughout my entire application. (Person is logged in but is not really logged in)

**Update 3B**

After some digging I saw some comments on a page that say the &quot;forms&quot; authentication timeout and session timeout need to match. I am thinking normally the two are in sync but for whatever reason the two are not in sync.

**Summary of Workarounds**

1) Always create a Session first before authentication. Basically create session when you start the application `Session[&quot;Workaround&quot;] = 0;`

2) [Experimental] if you persist cookies make sure your OWIN timeout / length is longer than your sessionTimeout in your web.config (in testing)


ASP.NET_SessionId + OWIN Cookies do not send to browser

I have been searching for an hour trying to figure out why this isn&#39;t working.

I have a ASP.Net MVC 5 application with a WebAPI.  I am trying to get Request.GetOwinContext().Authentication, however I can&#39;t seem to find how to include GetOwinContext.  Here is my code:

    using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Net;
    using System.Net.Http;
    using System.Web;
    using System.Web.Mvc;
    using System.Web.Security;
    using TaskPro.Models;

    namespace TaskPro.Controllers.api
    {
        public class AccountController : ApiController
        {
            [HttpPost]
            [AllowAnonymous]
            public ReturnStatus Login(LoginViewModel model)
            { 
                if (ModelState.IsValid)
                {
                    var ctx = Request.GetOwinContext(); // &lt;-- Can&#39;t find this

                    return ReturnStatus.ReturnStatusSuccess();
                }

                return base.ReturnStatusErrorsFromModelState(ModelState);
            }
        }
    }

From what I&#39;ve read, it should be part of the System.Net.Http, but I&#39;ve included that and it still isn&#39;t resolving.  Ctrl-Space doesn&#39;t give me any intellisense options either.

What am I missing here?


Can&#39;t find Request.GetOwinContext

This error 

The following errors occurred while attempting to load the app.
- No assembly found containing an OwinStartupAttribute.
- The given type or method &#39;false&#39; was not found. Try specifying the Assembly.
To disable OWIN startup discovery, add the appSetting owin:AutomaticAppStartup with a value of &quot;false&quot; in your web.config.
To specify the OWIN startup Assembly, Class, or Method, add the appSetting owin:AppStartup with the fully qualified startup class or configuration method name in your web.config.

appears on my screen on the most face burningly ugly error page ever created in history. 

[![enter image description here][1]][1]

Ive tried to follow the instructions on the page by inserting the owin:AutomaticAppStartup in the config.

     &lt;appSettings &gt;
        &lt;add key=&quot;owin:AppStartup&quot; value=&quot;false&quot;&gt;&lt;/add&gt;
            &lt;/appSettings&gt;

this did not fix the problem. Any suggestions?

  [1]: http://i.stack.imgur.com/rDKpi.jpg

No assembly found containing an OwinStartupAttribute Error

I am using the Web Api 2 template that comes with Visual Studio 2013 has some OWIN middleware to do User Authentication and the likes of.

In the `OAuthAuthorizationServerOptions` I noticed that the OAuth2 Server is setup to hand out tokens that expire in 14 days

     OAuthOptions = new OAuthAuthorizationServerOptions
     {
          TokenEndpointPath = new PathString(&quot;/api/token&quot;),
          Provider = new ApplicationOAuthProvider(PublicClientId,UserManagerFactory) ,
          AuthorizeEndpointPath = new PathString(&quot;/api/Account/ExternalLogin&quot;),
          AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
          AllowInsecureHttp = true
     };

This is not suitable for my latest project. I would like to hand out short lived bearer_tokens that can be refreshed using a `refresh_token`

I have done lots of googling and can&#39;t find anything helpful.

So this is how far I have managed to get. I have now reached the point of &quot;WTF do I now&quot;.

I have written a `RefreshTokenProvider` that implements `IAuthenticationTokenProvider` as per the `RefreshTokenProvider` property on `OAuthAuthorizationServerOptions` class:

        public class SimpleRefreshTokenProvider : IAuthenticationTokenProvider
        {
           private static ConcurrentDictionary&lt;string, AuthenticationTicket&gt; _refreshTokens = new ConcurrentDictionary&lt;string, AuthenticationTicket&gt;();

	        public async Task CreateAsync(AuthenticationTokenCreateContext context)
	        {
	            var guid = Guid.NewGuid().ToString();
	
	            
	            _refreshTokens.TryAdd(guid, context.Ticket);
	
	            // hash??
	            context.SetToken(guid);
	        }
	
	        public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)
	        {
	            AuthenticationTicket ticket;
	
	            if (_refreshTokens.TryRemove(context.Token, out ticket))
	            {
	                context.SetTicket(ticket);
	            }
	        }
	
	        public void Create(AuthenticationTokenCreateContext context)
	        {
	            throw new NotImplementedException();
	        }
	
	        public void Receive(AuthenticationTokenReceiveContext context)
	        {
	            throw new NotImplementedException();
	        }
    	}

		// Now in my Startup.Auth.cs
		OAuthOptions = new OAuthAuthorizationServerOptions
		{
			TokenEndpointPath = new PathString(&quot;/api/token&quot;),
			Provider = new ApplicationOAuthProvider(PublicClientId,UserManagerFactory) ,
			AuthorizeEndpointPath = new PathString(&quot;/api/Account/ExternalLogin&quot;),
			AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(2),
			AllowInsecureHttp = true,
			RefreshTokenProvider = new RefreshTokenProvider() // This is my test
		};

So now when someone requests a `bearer_token` I am now sending a `refresh_token`, which is great.

So now how do I uses this refresh_token to get a new `bearer_token`, presumably I need to send a request to my token endpoint with some specific HTTP Headers set?

Just thinking out loud as I type... Should I handle refresh_token expiration in my `SimpleRefreshTokenProvider`? How would a client obtain a new `refresh_token`?

I could really do with some reading material / documentation because I don&#39;t want to get this wrong and would like to follow some sort of standard.





OWIN Security - How to Implement OAuth2 Refresh Tokens

I have followed [this article][1] to implement an OAuth Authorization server. However when I use post man to get a token, I get an error in the response:

&gt;&quot;error&quot;: &quot;unsupported_grant_type&quot;

I read somewhere that the data in Postman needs to be posted using `Content-type:application/x-www-form-urlencoded`. I have prepped the required settings in Postman:

![enter image description here][2]

and yet my headers are like this:

![enter image description here][3]

Here is my code

    public class CustomOAuthProvider : OAuthAuthorizationServerProvider
    {
        public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
        {
            context.Validated();
            return Task.FromResult&lt;object&gt;(null);
        }

        public override Task MatchEndpoint(OAuthMatchEndpointContext context)
        {
            if (context.OwinContext.Request.Method == &quot;OPTIONS&quot; &amp;&amp; context.IsTokenEndpoint)
            {
                context.OwinContext.Response.Headers.Add(&quot;Access-Control-Allow-Methods&quot;, new[] { &quot;POST&quot; });
                context.OwinContext.Response.Headers.Add(&quot;Access-Control-Allow-Headers&quot;, new[] { &quot;accept&quot;, &quot;authorization&quot;, &quot;content-type&quot; });
                context.OwinContext.Response.StatusCode = 200;
                context.RequestCompleted();
                return Task.FromResult&lt;object&gt;(null);
            }
            return base.MatchEndpoint(context);       
        }

        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
            string allowedOrigin = &quot;*&quot;;

            context.OwinContext.Response.Headers.Add(&quot;Access-Control-Allow-Origin&quot;, new[] { allowedOrigin });
            context.OwinContext.Response.Headers.Add(&quot;Access-Control-Allow-Headers&quot;, new[] { &quot;Content-Type&quot; });

            Models.TheUser user = new Models.TheUser();
            user.UserName = context.UserName;
            user.FirstName = &quot;Sample first name&quot;;
            user.LastName = &quot;Dummy Last name&quot;;

            ClaimsIdentity identity = new ClaimsIdentity(&quot;JWT&quot;);

            identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));
            foreach (string claim in user.Claims)
            {
                identity.AddClaim(new Claim(&quot;Claim&quot;, claim));    
            }
            
            var ticket = new AuthenticationTicket(identity, null);
            context.Validated(ticket);
        }
    }

    public class CustomJwtFormat : ISecureDataFormat&lt;AuthenticationTicket&gt;
    {
        private readonly string _issuer = string.Empty;

        public CustomJwtFormat(string issuer)
        {
            _issuer = issuer;
        }

        public string Protect(AuthenticationTicket data)
        {
            string audienceId = ConfigurationManager.AppSettings[&quot;AudienceId&quot;];
            string symmetricKeyAsBase64 = ConfigurationManager.AppSettings[&quot;AudienceSecret&quot;];
            var keyByteArray = TextEncodings.Base64Url.Decode(symmetricKeyAsBase64);
            var signingKey = new HmacSigningCredentials(keyByteArray);
            var issued = data.Properties.IssuedUtc;
            var expires = data.Properties.ExpiresUtc;
            var token = new JwtSecurityToken(_issuer, audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey);
            var handler = new JwtSecurityTokenHandler();
            var jwt = handler.WriteToken(token);
            return jwt;
        }

        public AuthenticationTicket Unprotect(string protectedText)
        {
            throw new NotImplementedException();
        }
    }

In the CustomJWTFormat class above only the breakpoint in the constructor gets hit. In the CustomOauth class, the breakpoint in the GrantResourceOwnerCredentials method never gets hit. The others do. 

The Startup class:

    public class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
            
            HttpConfiguration config = new HttpConfiguration();
            WebApiConfig.Register(config);

            ConfigureOAuthTokenGeneration(app);
            ConfigureOAuthTokenConsumption(app);
            
            app.UseWebApi(config);
        }
    
        private void ConfigureOAuthTokenGeneration(IAppBuilder app)
        {
            var OAuthServerOptions = new OAuthAuthorizationServerOptions()
            {
                //For Dev enviroment only (on production should be AllowInsecureHttp = false)
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString(&quot;/oauth/token&quot;),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = new CustomOAuthProvider(),
                AccessTokenFormat = new CustomJwtFormat(ConfigurationManager.AppSettings[&quot;Issuer&quot;])
            };

            // OAuth 2.0 Bearer Access Token Generation
            app.UseOAuthAuthorizationServer(OAuthServerOptions);
        }

        private void ConfigureOAuthTokenConsumption(IAppBuilder app)
        {
            string issuer = ConfigurationManager.AppSettings[&quot;Issuer&quot;]; 
            string audienceId = ConfigurationManager.AppSettings[&quot;AudienceId&quot;];
            byte[] audienceSecret = TextEncodings.Base64Url.Decode(ConfigurationManager.AppSettings[&quot;AudienceSecret&quot;]);

            // Api controllers with an [Authorize] attribute will be validated with JWT
            app.UseJwtBearerAuthentication(
                new JwtBearerAuthenticationOptions
                {
                    AuthenticationMode = AuthenticationMode.Active,
                    AllowedAudiences = new[] { audienceId },
                    IssuerSecurityTokenProviders = new IIssuerSecurityTokenProvider[]
                    {
                        new SymmetricKeyIssuerSecurityTokenProvider(issuer, audienceSecret)
                    }
                });
        }
    }

Do I need to set up `Content-type:application/x-www-form-urlencoded` somewhere else in the web api code? What could be wrong? Please help.


  [1]: http://bitoftech.net/2015/02/16/implement-oauth-json-web-tokens-authentication-in-asp-net-web-api-and-identity-2/
  [2]: http://i.stack.imgur.com/ckYWz.png
  [3]: http://i.stack.imgur.com/gtkRP.png

Getting &quot;error&quot;: &quot;unsupported_grant_type&quot; when trying to get a JWT by calling an OWIN OAuth secured Web Api via Postman

I have copied a previous project and renamed it. Once I had successfully renamed all the name spaces and it build correctly. I got the following error when I ran the application:

    The following errors occurred while attempting to load the app.
    - The OwinStartup attribute discovered in assembly &#39;User Manager Interface&#39; referencing    startup type &#39;User_Manager_Interface.Startup&#39; conflicts with the attribute in assembly   &#39;Service Monitor Web Interface&#39; referencing startup type  &#39;Service_Monitor_Web_Interface.Startup&#39; because they have the same FriendlyName &#39;&#39;. Remove or   rename one of the attributes, or reference the desired type directly.
    To disable OWIN startup discovery, add the appSetting owin:AutomaticAppStartup with a value of &quot;false&quot; in your web.config.
    To specify the OWIN startup Assembly, Class, or Method, add the appSetting owin:AppStartup with the fully qualified startup class or configuration method name in your web.config.


I have figured out that if I comment out the first line below then the error goes away.

    //[assembly: OwinStartupAttribute(typeof(Service_Monitor_Web_Interface.Startup))]
    namespace Service_Monitor_Web_Interface
    {
    public partial class Startup
    {
        public void Configuration(IAppBuilder app)
        {
            ConfigureAuth(app);
        }
    }
    }


I renamed my solution from User_Manager_Interface to Service_Monitor_Web_Interface.

I cant seem to find any places with the old name, howevel in the error it mentions it.

Error renaming ASP.NET MVC project

I would like the following architecture (I&#39;ve made up the product name for this example):

**Web API 2 application running on one server**
http://api.prettypictures.com

**MVC 5 client app running on another server**
http://www.webpics.com

I would like **www.webpics.com** client app to use the Pretty Pictures API to:

 - Register new accounts with username and password
 - Register new accounts with Facebook/Google/Twitter/Microsoft
 - Log in
 - Retrieve pictures

All of the above works except registering external accounts with Facebook, Google etc.

I cannot work out the correct flow to create an **external** account from a separate client user of the API.

I have studied most documents available on the authentication flow, like this:
![enter image description here][1]

I have read pretty much everything I can on the new Identity model in OWIN.

I&#39;ve examined the SPA template in Visual Studio 2013. It demonstrates how to do most of what I need but only when the client and the API are on the same host; if I want multiple clients accessing my API and being able to let users sign up via Google etc. it doesn&#39;t work and as far as I can tell the OWIN authentication flow breaks.

Here is the flow so far:

- User browses to **www.webpics.com/Login**
- **www.webpics.com** calls **api.prettypictures.com/Account/ExternalLogins** (with a **returnUrl** set to go back to a callback at **www.webpics.com**) and displays the resulting links to the user
- The user clicks &quot;Google&quot;
- The browser redirects to **api.prettypictures.com/Account/ExternalLogin** with the name of the provider etc.
- The API&#39;s **ExternalLogin** action instantiates a challenge to **google.com**
- The browser is redirected to **google.com**
- The user enters their username and password (if they are not already logged in to **google.com**)
- **google.com** now presents the security clearance: **&quot;api.prettypictures.com&quot; would like access to your email address, name, wife, children etc. Is this OK?**
- User clicks &quot;Yep&quot; and is taken back to **api.prettypictures.com/Account/ExternalLogin** with a cookie that Google has set.

This is where I&#39;ve got stuck. What is supposed to happen next is somehow the client app should be notified that the user has successfully authenticated with **google.com** and be given a single use access code to swap for an access token later on. The client app should have the opportunity, if necessary, to prompt the user for a username to associate with their **google.com** login.

I don&#39;t know how to facilitate this.

In fact at this point the browser ends up sat at the **api.prettypictures.com/Account/ExternalLogin** endpoint after the callback from Google. The API is signed in for Google but the client doesn&#39;t know how to deal with that. Should I pipe that cookie back to **www.webpics.com**?

In the SPA app, it is done via AJAX and **google.com** will return an token as a URL fragment and it all works nicely because it all sits on one domain. But that defies much of the point of having an &quot;API&quot; that multiple clients can fully use.

Help!

  [1]: http://i.stack.imgur.com/fF67o.png

Registering Web API 2 external logins from multiple API clients with OWIN Identity

I am working on an Asp.Net MVC 4 Application in which I am using SignalR 2.0.1 and I Mapped it using Owin Startup class and it worked fine at first.

All of a sudden when I tried to rebuild my app it said that the type are namespace `IAppbuilder` could not be found.

Following is my start up class

    using Microsoft.Owin;
    using Owin;
    using WhiteBoardApp;
    
    namespace WhiteBoardApp
    {
        public class Startup
        {
            public void Configuration(IAppBuilder app)
            {
                app.MapSignalR();
            }
        }
    }


I have installed `Owin` package too, and for some reasons I could not find Owin Startup class so I just added a normal class and included all the references that are needed. 
May I know where I am making a mistake

The type or namespace IAppBuilder could not be found(missing using a directive pr an assembly reference)

I had the OwinStartup configuration code working perfectly and then it stopped working.  Unfortunately I&#39;m not sure exactly what I did to get it to stop working and am having a really hard time figuring it out.  

To make sure I have the basics covered, I doubled checked to make sure the I have the 

    [assembly:OwinStartup(typeof(WebApplication.Startup))] 

attribute assigned properly and made sure that I don&#39;t have an appSetting for owin:AutomaticAppStartup that is set to false so I made one set to true to be safe as there was nothing there before.

    &lt;add key=&quot;owin:AutomaticAppStartup&quot; value=&quot;true&quot; /&gt;

I also tried specifically calling out the appSetting:

    &lt;add key=&quot;owin:appStartup&quot; value=&quot;WebApplication.Startup&quot; /&gt;

Before it stopped working I upgraded the Microsoft.Owin.Security NuGet packages to 2.0.2, so I tried reverting them to 2.0.1 (that was a pain) but it didn&#39;t change anything.  I have WebActivator installed on the project and am using that to bootstrap other things but I&#39;ve tested that on a fresh WebApplication template and it works there so I don&#39;t think that is the culprit.

I also tried removing my Startup class and using Visual Studio to add a new one using the OWIN Startup Class type in Add New Item and that isn&#39;t getting called either.  Next I tried adding a second Startup class since I know it will throw an exception if there is more than one OwinStartup attributes defined, but it isn&#39;t throwing any exception there.

Not sure what else to try.  Any thoughts?

**Update**

Turns out that Resharper removed the reference to Microsoft.Owin.Host.SystemWeb when I used it to remove unused references.

OwinStartup not firing

After trying to enable owin &amp; AspNet Identity to my Web Api project (in VS 2013 + .Net 4.5.1) I get the following error in each valid or unvalid(request to none exist controller) requests :

    &lt;Error&gt;
    &lt;Message&gt;An error has occurred.&lt;/Message&gt;
    &lt;ExceptionMessage&gt;
    No OWIN authentication manager is associated with the request.
    &lt;/ExceptionMessage&gt;
    &lt;ExceptionType&gt;System.InvalidOperationException&lt;/ExceptionType&gt;
    &lt;StackTrace&gt;
    at System.Web.Http.Owin.PassiveAuthenticationMessageHandler.SuppressDefaultAuthenticationChallenges(HttpRequestMessage request) at System.Web.Http.Owin.PassiveAuthenticationMessageHandler.&lt;SendAsync&gt;d__0.MoveNext() --- End of stack trace from previous location where exception was thrown --- at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task) at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task) at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult() at System.Web.Http.HttpServer.&lt;SendAsync&gt;d__0.MoveNext()
    &lt;/StackTrace&gt;
    &lt;/Error&gt;

As I checked in debug mode, no exception is handled too! Also I realized that `Configuration` in `Startup` class is never called (indeed never caught by the debugger). here is the code for startup :

    [assembly: OwinStartup(typeof(bloob.bloob.Startup))]
    
    namespace bloob.bloob
    {
        public partial class Startup
        {
            public void Configuration(IAppBuilder app)
            {
                ConfigureAuth(app);
            }
        }
    }


No OWIN authentication manager is associated with the request

When I try to start :

    WebApp.Start&lt;SrvcHst&gt;(new StartOptions { Port = 9956, 
         ServerFactory = &quot;Microsoft.Owin.Host.HttpListener&quot; });

I get the following exception. What could be the root cause?


    System.MissingMemberException was caught
      HResult=-2146233070
      Message=The server factory could not be located for the given input: Microsoft.Owin.Host.HttpListener
      Source=Microsoft.Owin.Hosting
      StackTrace:
           at Microsoft.Owin.Hosting.Engine.HostingEngine.ResolveServerFactory(StartContext context)
           at Microsoft.Owin.Hosting.Engine.HostingEngine.Start(StartContext context)
           at Microsoft.Owin.Hosting.Starter.DirectHostingStarter.Start(StartOptions options)
           at Microsoft.Owin.Hosting.Starter.HostingStarter.Start(StartOptions options)
           at Microsoft.Owin.Hosting.WebApp.StartImplementation(IServiceProvider services, StartOptions options)
           at Microsoft.Owin.Hosting.WebApp.Start(StartOptions options)
           at Microsoft.Owin.Hosting.WebApp.Start[TStartup](StartOptions options)

OWIN HttpListener not located

I have a single page app - more or less based on the MVC5 SPA template - using **bearer tokens** for authentication.

The site also has a couple of conventional MVC pages which need to be secured, but using **cookie authentication**.

In Startup.Auth I can enable both types of authorisation:

    app.UseCookieAuthentication(new CookieAuthenticationOptions());
    app.UseOAuthBearerTokens(OAuthOptions);

However, this seems to have a side-effect in that whenever an AJAX request is sent from the SPA, it sends both the bearer token in the header **and** the cookie.

Whereas the behaviour I really want is that **only** the bearer token is used for WebAPI calls, and only the cookie for MVC calls.

I&#39;d also like the MVC calls to redirect to a login page when not authorised (set as a CookieAuthenticationOption), but obviously I don&#39;t want this to happen when making an API call.

Is there some way to have this type of mixed-mode authentication within one application?  Perhaps through a path/route filter?

Using bearer tokens and cookie authentication together

I&#39;m following a Microsoft sample to implement email validation with Identity 2.0.0

I&#39;m stuck at this part

    public ApplicationUserManager UserManager
    {
       get
       {
          return _userManager ?? HttpContext.GetOwinContext().GetUserManager&lt;ApplicationUserManager&gt;();
       }
       private set
       {
          _userManager = value;
       }
    }

This works in an `controller` but `HttpContext` doesn&#39;t contain any `GetOwinContext` method in an **ApiController**.

So I tried `HttpContext.Current.GetOwinContext()` but the method `GetUserManager` doesn&#39;t exist.


I can&#39;t figure out a way to get the `UserManager` I build in **Startup.Auth.cs**


 

    // For more information on configuring authentication, please visit http://go.microsoft.com/fwlink/?LinkId=301864
    public void ConfigureAuth(IAppBuilder app)
    {
        //Configure the db context, user manager and role manager to use a single instance per request
        app.CreatePerOwinContext(ApplicationDbContext.Create);
        app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create); 
        ...
    }


this line 

    app.CreatePerOwinContext&lt;ApplicationUserManager&gt;(ApplicationUserManager.Create);

calls the following function to configure the `UserManager`

    public static ApplicationUserManager Create(IdentityFactoryOptions&lt;ApplicationUserManager&gt; options, IOwinContext context)
    {
         var manager = new ApplicationUserManager(new UserStore&lt;ApplicationUser&gt;(context.Get&lt;ApplicationDbContext&gt;()));
         //Configure validation logic for usernames
         manager.UserValidator = new UserValidator&lt;ApplicationUser&gt;(manager)
         {
             AllowOnlyAlphanumericUserNames = false,
             RequireUniqueEmail = true
         };
    
         // Configure user lockout defaults
         manager.UserLockoutEnabledByDefault = true;
         manager.DefaultAccountLockoutTimeSpan = TimeSpan.FromMinutes(5);
         manager.MaxFailedAccessAttemptsBeforeLockout = 5;
    
         manager.EmailService = new EmailService();
    
         var dataProtectionProvider = options.DataProtectionProvider;
         if (dataProtectionProvider != null)
         {
             manager.UserTokenProvider = new DataProtectorTokenProvider&lt;ApplicationUser&gt;(dataProtectionProvider.Create(&quot;ASP.NET Identity&quot;));
         }
         return manager;
    }

 How can I access this `UserManager` in an `ApiController`?

Can&#39;t get UserManager from OwinContext in apicontroller

(ASP.NET MVC 5, EF6, VS2013)

I&#39;m trying to figure out how to **change the type of the &quot;Id&quot; field from string to int** in the type:

    Microsoft.AspNet.Identity.EntityFramework.IdentityUser

in order to have new user accounts be associated with an integer ID rather than a GUID. But it seems like this will be more complicated than simply adding a new Id property with type int in my derived user class. Take a look at this method signature:

(from Assembly Microsoft.AspNet.Identity.Core.dll)

    public class UserManager&lt;TUser&gt; : IDisposable where TUser : global::Microsoft.AspNet.Identity.IUser
      {
      ...
      public virtual Task&lt;IdentityResult&gt; AddLoginAsync(string userId, UserLoginInfo login);
      ...
      }

So it seems that there are other methods baked into the ASP.NET identity framework which require the userId to be a string. Would I need to reimplement these classes as well?

**An explanation of why I don&#39;t want to store GUIDs for ids in the user table:**

-There will be other tables that relate data to the users table via a foreign key. (When users save content on the site.) I see no reason to use the larger field type and spend extra database space with no clear advantages. (I know that there are other posts about using GUIDs vs int ids, but it seems like many suggest that int ids are faster and use less space, which still leaves me wondering.)

-I plan to expose a restful endpoint to allow users to retrieve data about a particular user. I think:

    /users/123/name

is cleaner than

    /users/{af54c891-69ba-4ddf-8cb6-00d368e58d77}/name

Does anyone know why the ASP.NET team decided to implement IDs this way? Am I being short sighted in trying to change this to an int type? (Perhaps there are benefits I&#39;m missing.)

Thanks...

-Ben

How to change type of id in Microsoft.AspNet.Identity.EntityFramework.IdentityUser

I&#39;ve created a new MVC5 Web Application, and when I try to login with Google or Facebook, the `ExternalLoginCallback` Action in the `AccountController` is called, but `GetExternalLoginInfoAsync()` always returns null:

    var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
    if (loginInfo == null)
    {
        return RedirectToAction(&quot;Login&quot;);
    }

Because it&#39;s always null, it just redirects back to the login page and the process starts over. How can I fix this?

OWIN&#39;s GetExternalLoginInfoAsync Always Returns null

I started getting this error recently when trying to login using twitter- any idea why?

    Stack Trace: 
    
    
    [AuthenticationException: The remote certificate is invalid according to the validation procedure.]
       System.Net.TlsStream.EndWrite(IAsyncResult asyncResult) +230
       System.Net.PooledStream.EndWrite(IAsyncResult asyncResult) +13
       System.Net.ConnectStream.WriteHeadersCallback(IAsyncResult ar) +123
    
    [WebException: The underlying connection was closed: Could not establish trust relationship for the SSL/TLS secure channel.]
       System.Net.HttpWebRequest.EndGetResponse(IAsyncResult asyncResult) +6432446
       System.Net.Http.HttpClientHandler.GetResponseCallback(IAsyncResult ar) +64



Owin Twitter login - the remote certificate is invalid according to the validation procedure

I have implemente signalR in window service.

    private IDisposable SignalR { get; set; }

    public void Configuration(IAppBuilder app)
    {   
            var hubconfig=new Microsoft.AspNet.SignalR.HubConfiguration();
            hubconfig.EnableJSONP = true;
                        
            app.UseCors(CorsOptions.AllowAll);
            app.MapSignalR(hubconfig);
    }


    private void StartSignalRServer(StringBuilder sbLog)
    {
            try
            {
                this.SignalR = WebApp.Start(ServerURI); //This throws exception

                //this.SignalR= WebApp.Start&lt;Startup&gt;(ServerURI);
                sbLog.Append(string.Format(&quot;{0}--------SignalR Server Started------&quot;,Environment.NewLine));
            }
            catch (Exception ex)
            {
                sbLog.Append(string.Format(&quot;{0}Exception in StartSignalRServer=&gt;{1}&quot;, Environment.NewLine,ex.Message));
            }
    }


&gt; Exception:The server factory could not be located for the given input:
&gt; Microsoft.Owin.Host.HttpListener

The server factory could not be located for the given input: Microsoft.Owin.Host.HttpListener

It&#39;s a Web API 2 project.

When I implement DI using Ninject, I got an error message

An error occurred when trying to create a controller of type &#39;TokenController&#39;. Make sure that the controller has a parameterless public constructor.

    [assembly: OwinStartup(typeof(Web.Startup))]

    namespace Web
    {
        public partial class Startup
        {
            public void Configuration(IAppBuilder app)
            {
                ConfigureAuth(app);
                ConfigureWebApi(app);
            }
        }
    }

    public class TokenController : ApiController
    {

        private IUserService _userService;

        public TokenController(IUserService userService)
        {
            this._userService = userService;
        }

        [Route(&quot;api/Token&quot;)]
        public HttpResponseMessage PostToken(UserViewModel model)
        {
            if (_userService.ValidateUser(model.Account, model.Password))
            {
                ClaimsIdentity identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType);
                identity.AddClaim(new Claim(ClaimTypes.Name, model.Account));
                AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties());
                var currentUtc = new SystemClock().UtcNow;
                ticket.Properties.IssuedUtc = currentUtc;
                ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromMinutes(30));
                return new HttpResponseMessage(HttpStatusCode.OK)
                {
                    Content = new ObjectContent&lt;object&gt;(new
                    {
                        UserName = model.Account,
                        AccessToken = Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket)
                    }, Configuration.Formatters.JsonFormatter)
                };
            }

            return new HttpResponseMessage(HttpStatusCode.BadRequest);
        }
    }

When I add `&lt;add key=&quot;owin:AutomaticAppStartup&quot; value=&quot;false&quot; /&gt;` to web.config

Ninject works fine, 
but **Startup.OAuthBearerOptions.AccessTokenFormat** becomes to null

How to use DI container with OWIN?

**UPDATE**

Implement IDependencyResolver and use the WebAPI Dependency Resolver as below

    public void ConfigureWebApi(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();

        config.DependencyResolver = new NinjectDependencyResolver(NinjectWebCommon.CreateKernel());

        app.UseWebApi(config);
    }

[NinjectDependencyResolver](http://www.peterprovost.org/blog/2012/06/19/adding-ninject-to-web-api)

---

In Simple Injector case

    public void ConfigureWebApi(IAppBuilder app)
    {
        HttpConfiguration config = new HttpConfiguration();

        var container = new Container();
        container.Register&lt;IUserService, UserService&gt;();
        config.DependencyResolver = new SimpleInjectorWebApiDependencyResolver(container);

        app.UseWebApi(config);
    }

[SimpleInjectorWebApiDependencyResolver](http://simpleinjector.codeplex.com/wikipage?title=Web%20API%20Integration)

How to use DI container when OwinStartup

**Update 2017!**

The issue I had when I posted the original question has got nothing to do with the recent changes Facebook made when they forced everyone to version 2.3 of their API.  For a solution to that specific problem, see **sammy34&#39;s answer below**.  Version 2.3 of the /oauth/access_token endpoint now returns JSON instead of form-encoded values

**For historical reasons, here&#39;s my original question/issue:**

I&#39;ve got an MVC5 Web application which is using the built-in support for authentication via Facebook and Google.  When we built this app a few months ago, we followed this tutorial: http://www.asp.net/mvc/tutorials/mvc-5/create-an-aspnet-mvc-5-app-with-facebook-and-google-oauth2-and-openid-sign-on and everything worked great.

Now, all of a sudden, the Facebook authentication has just stopped working alltogether.  The Google authentication still works great.

Description of the problem: We click the link to connect using Facebook, we are redirected to Facebook where we are prompted if we wan&#39;t to allow our Facebook app access to our profile.  When we click &quot;OK&quot; we are redirected back to our site, but instead of being logged in we simply end up at the login screen.

I&#39;ve gone through this process in debug mode and I&#39;ve got this ActionResult in my account controller as per the tutorial mentioned above:

    // GET: /Account/ExternalLoginCallback
    [AllowAnonymous]
    public async Task&lt;ActionResult&gt; ExternalLoginCallback(string returnUrl)
    {
        var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
        if (loginInfo == null)
        {
            return RedirectToAction(&quot;Login&quot;);
        }
        ............

When stepping through the code and upon returning from Facebook, the loginInfo object is always NULL, which causes the user to be redirected back to the login.

In order to understand what is actually happening behind the scenes, I installed Fiddler and monitored the HTTP traffic.  What I disovered is that upon clicking &quot;OK&quot; at the Facebook permission dialog, Facebook redirects back to our application with this URL:

    https://localhost/signin-facebook?code=&lt;access-token&gt;

This URL is not an actual file and probably handled by some controller/handler built into this OWIN framework I&#39;m guessing.  Most likely, it is connecting back to Facebook using the given code to query information about the user which is trying to login.  Now, the problem is that instead of doing that, we are redirected to:

    /Account/ExternalLoginCallback?error=access_denied

Which I&#39;m sure is something Facebook is doing, that is, instead of giving us the user data, it&#39;s redirecting us back with this error message.

This causes the `AuthenticationManager.GetExternalLoginInfoAsync();` to fail and always return NULL.

I&#39;m completely out of ideas.  As far as we know, we did not change anything on our end.

I&#39;ve tried creating a new Facebook app, I&#39;ve tried following the tutorial again but I always have the same problem.

Any ideas welcome!

**Update!**

OK, this is driving me insane!  I&#39;ve now manually gone through the steps required to perform the authentication and everything works great when I do that.  Why on earth is this not working when using the MVC5 Owin stuff?

This is what I did:

        // Step 1 - Pasted this into a browser, this returns a code
        https://www.facebook.com/dialog/oauth?response_type=code&amp;client_id=619359858118523&amp;redirect_uri=https%3A%2F%2Flocalhost%2Fsignin-facebook&amp;scope=&amp;state=u9R1m4iRI6Td4yACEgO99ETQw9NAos06bZWilJxJrXRn1rh4KEQhfuEVAq52UPnUif-lEHgayyWrsrdlW6t3ghLD8iFGX5S2iUBHotyTqCCQ9lx2Nl091pHPIw1N0JV23sc4wYfOs2YU5smyw9MGhcEuinvTAEql2QhBowR62FfU6PY4lA6m8pD3odI5MwBYOMor3eMLu2qnpEk0GekbtTVWgQnKnH6t1UcC6KcNXYY
    
    I was redirected back to localhost (which I had shut down at this point to avoid being redirected immediately away).  The URL I was redirected to is this:
    
    https://localhost/signin-facebook?code=&lt;code-received-removed-for-obvious-reasons&gt;
    
    Now, I grabbed the code I got and used it in the URL below:
    
    // Step 2 - opened this URL in a browser, and successfully retrieved an access token
    https://graph.facebook.com/oauth/access_token?client_id=619359858118523&amp;redirect_uri=https://localhost/signin-facebook&amp;client_secret=&lt;client-secret&gt;&amp;code=&lt;code-from-step-1&gt;
    
    // Step 3 - Now I&#39;m able to query the facebook graph using the access token from step 2!
    
    https://graph.facebook.com/me?access_token=&lt;access-token-from-step-2&gt;


No errors, everything works great!  Then why the hell is this not working when using the MVC5 Owin stuff?  There&#39;s obviously something wrong with the OWin implementation.

ASP.NET MVC5 OWIN Facebook authentication suddenly not working

I have read many articles about the OWIN and Katana projects, but I could not get the whole picture of it. 

For a normal web developer who uses ASP.NET:

 1. What exactly is OWIN and what problems does it solve (in simple words). What is its relation to IIS?
 2. Does OWIN replace IIS? if not, in what situations does OWIN best fit?
 3. How could OWIN help me in my daily work projects?
 4. How could OWIN help me in a self-improvement projects?

How to explain Katana and OWIN in simple words and uses?

I have created a WebApi and a Cordova application.
I am using HTTP requests to communicate between the Cordova application and the WebAPI.
In the WebAPI, I&#39;ve implemented OAuth Bearer Token Generation.

    public void ConfigureOAuth(IAppBuilder app)
        {
            var oAuthServerOptions = new OAuthAuthorizationServerOptions
            {
                AllowInsecureHttp = true,
                TokenEndpointPath = new PathString(&quot;/token&quot;),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
                Provider = new SimpleAuthorizationServerProvider(new UserService(new Repository&lt;User&gt;(new RabbitApiObjectContext()), new EncryptionService()))
            };

            // Token Generation
            app.UseOAuthAuthorizationServer(oAuthServerOptions);
            app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());

        }

and this is inside the `SimpleAuthorizationServerProvider` implementation

     public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
        {
           context.OwinContext.Response.Headers.Add(&quot;Access-Control-Allow-Origin&quot;, new[] { &quot;*&quot; });

            // A little hack. context.UserName contains the email
            var user = await _userService.GetUserByEmailAndPassword(context.UserName, context.Password);

            if (user == null)
            {
                context.SetError(&quot;invalid_grant&quot;, &quot;Wrong email or password.&quot;);
                return;
            }

            var identity = new ClaimsIdentity(context.Options.AuthenticationType);
            identity.AddClaim(new Claim(&quot;sub&quot;, context.UserName));
            identity.AddClaim(new Claim(&quot;role&quot;, &quot;user&quot;));

            context.Validated(identity);
        }

 
after a successful login request to the API from the Cordova app, I receive the following JSON

    {&quot;access_token&quot;:&quot;some token&quot;,&quot;token_type&quot;:&quot;bearer&quot;,&quot;expires_in&quot;:86399}

The problem is, that I require more information about the user. For example, I have a UserGuid field in the database and I want to send it to the Cordova app when the login is successful and to use it later in other requests. Can I include other information to return to the client, other than `&quot;access_token&quot;, &quot;token_type&quot;` and `&quot;expires_in&quot;`? If not, how can I get the user in the API based on the `access_token`?


----------


**EDIT:**

I think that I found a workaround. 
I added the following code inside `GrantResourceOwnerCredentials`

    identity.AddClaim(new Claim(ClaimTypes.Name, user.UserGuid.ToString()));

and after that, I access the GUID inside my controller like this: `User.Identity.Name`

I also can add the the guid with a custom name `identity.AddClaim(new Claim(&quot;guid&quot;, user.UserGuid.ToString()));`

I&#39;m still interested to know if there is a way to return more data to the client with the bearer token JSON.

Return more info to the client using OAuth Bearer Tokens Generation and Owin in WebApi

I had a version number problem with system.web.http.owin.

So I removed it from my projects package references, with the idea that I would re-added it to see if it fixed the problem. However it has disappeared completely. I.e. in visual studio if I go: 

solution explorer &gt; myProject &gt; references &gt; RMC &gt; add reference &gt; 

and then search for `system.web.http.owin` it doesn&#39;t appear.

Any ideas what has gone wrong or what package I need to install to make it re-appear.



My original error message...

&gt; Error	7	Assembly &#39;System.Web.Http.Owin, Version=5.1.0.0,
&gt; Culture=neutral, PublicKeyToken=31bf3856ad364e35&#39; uses
&gt; &#39;System.Web.Http, Version=5.1.0.0, Culture=neutral,
&gt; PublicKeyToken=31bf3856ad364e35&#39; which has a higher version than
&gt; referenced assembly &#39;System.Web.Http, Version=4.0.0.0,
&gt; Culture=neutral,
&gt; PublicKeyToken=31bf3856ad364e35&#39;	e:\user\project1\src\packages\Microsoft.AspNet.WebApi.Owin.5.1.1\lib\net45\System.Web.Http.Owin.dll	Smots.Core



How do I get System.Web.Http.Owin?

I am setting up bearer token authentication in Web API 2, and I don&#39;t understand how (or where) the bearer token is being stored server-side. Here is the relevant code:

**Startup:**

    public partial class Startup
    {
        public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
        public static Func&lt;UserManager&lt;IdentityUser&gt;&gt; UserManagerFactory { get; set; }
        public static string PublicClientId { get; private set; }

        static Startup()
        {
            PublicClientId = &quot;self&quot;;
            UserManagerFactory = () =&gt; new UserManager&lt;IdentityUser&gt;(new UserStore&lt;IdentityUser&gt;());
            OAuthOptions = new OAuthAuthorizationServerOptions
            {
                TokenEndpointPath = new PathString(&quot;/Token&quot;),
                Provider = new ApplicationOAuthProvider(PublicClientId, UserManagerFactory),
                AuthorizeEndpointPath = new PathString(&quot;/api/Account/ExternalLogin&quot;),
                AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
                AllowInsecureHttp = true
            };
        }

        public void ConfigureAuth(IAppBuilder app)
        {
            // Enable the application to use a cookie to store information for the signed in user
            app.UseCookieAuthentication(new CookieAuthenticationOptions());

            // Use a cookie to temporarily store information about a user logging in with a third party login provider
            app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);

            app.UseOAuthBearerTokens(OAuthOptions);
        }
    }


**WebApiConfig:**

    public class WebApiConfig
    {
        public static void ConfigureWebApi()
        {
            Register(GlobalConfiguration.Configuration);
        }

        public static void Register(HttpConfiguration http)
        {
            AuthUtil.ConfigureWebApiToUseOnlyBearerTokenAuthentication(http);
            http.Routes.MapHttpRoute(&quot;ActionApi&quot;, &quot;api/{controller}/{action}&quot;, new {action = Actions.Default});
        }
    }


**AuthUtil:**

    public class AuthUtil
    {
        public static string Token(string email)
        {
            var identity = new ClaimsIdentity(Startup.OAuthOptions.AuthenticationType);
            identity.AddClaim(new Claim(ClaimTypes.Name, email));
            var ticket = new AuthenticationTicket(identity, new AuthenticationProperties());
            var currentUtc = new SystemClock().UtcNow;
            ticket.Properties.IssuedUtc = currentUtc;
            ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromMinutes(30));
            var token = Startup.OAuthOptions.AccessTokenFormat.Protect(ticket);
            return token;
        }

        public static void ConfigureWebApiToUseOnlyBearerTokenAuthentication(HttpConfiguration http)
        {
            http.SuppressDefaultHostAuthentication();
            http.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));
        }
    }

**LoginController:**

    public class LoginController : ApiController
    {
        ...
        
        public HttpResponseMessage Post([FromBody] LoginJson loginJson)
        {
            HttpResponseMessage loginResponse;
            if (/* is valid login */)
            {
                var accessToken = AuthUtil.Token(loginJson.email);
                loginResponse = /* HTTP response including accessToken */;
            }
            else
            {
                loginResponse = /* HTTP response with error */;
            }
            return loginResponse;
        }
    }

Using the above code, I&#39;m able to login and store the bearer token client-side in a cookie, and then make calls to controllers marked with [Authorize] and it lets me in.

**My questions are:**

1. Where / how is the bearer token being stored server-side? It seems like this is hapenning through one of the OWIN calls but I can&#39;t tell where.

2. Is it possible to persist the bearer tokens to a database server-side so that they can remain in place after a Web API server restart?

3. If the answer to #2 is no, is there anyway for a client to maintain its bearer token and re-use it even after the Web API goes down and comes back up? While this may be rare in Production, it can happen quite often doing local testing.

How are bearer tokens stored server-side in Web API 2?

My understanding is currently you can self host WebAPI using Katana, and MVC will have this capability in a future version. Essentially Katana will be a hosting option available to both MVC and WebAPI.

Kestrel has entered the picture, and I see a few MS employees blogging about it demonstrating hosting ASP.NET vNext on Linux.

My understanding is that both Kestrel and Katana implement the OWIN pipeline.

From there it is all a bit fuzzy. I ask myself, why has Kestrel entered the picture, when it seems Katana could serve the same purpose if you compiled it with mono and made some efforts to make it cross platform compatible(perhaps easier said than done).

**Do Kestrel and Katana serve the same purpose?  Or is one specialized in some way that the other is not?**

Will Kestrel eventually be a viable choice for Windows deployments? Or will it be specialized for non-Windows environments and Katana still the choice for Windows?

I recognize that I&#39;m possibly asking for an apple to oranges comparison due to my lack of knowledge of Katana/Kestrel, but if the answer is &quot;Oranges have more of an acidic taste than apples&quot; then that IMO is a perfectly valid answer.

All Owin Solutions on Gang of Coders

Total of 38 Owin Solutions