title: Web API 2 /Token return more information
body: <p>I am using OAuth to generate tokens for my application, specifically JWT. I have this code in my startup class:</p>
  
  <pre><code>private void ConfigureOAuthTokenGeneration(IAppBuilder app)
  {
  
      // Configure the db context and user manager to use a single instance per request
      app.CreatePerOwinContext(DatabaseContext.Create);
      app.CreatePerOwinContext&lt;UserService&gt;(UserService.Create);
      app.CreatePerOwinContext&lt;RoleService&gt;(RoleService.Create);
  
      // Plugin the OAuth bearer JSON Web Token tokens generation and Consumption will be here
      var OAuthServerOptions = new OAuthAuthorizationServerOptions()
      {
          //For Dev enviroment only (on production should be AllowInsecureHttp = false)
          AllowInsecureHttp = true,
          TokenEndpointPath = new PathString("/oauth/token"),
          AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
          Provider = new OAuthProvider(),
          AccessTokenFormat = new CustomJwtFormat("http://localhost:58127")
      };
  
      // OAuth 2.0 Bearer Access Token Generation
      app.UseOAuthAuthorizationServer(OAuthServerOptions);
  }
  </code></pre>
  
  <p>As you can see I have set a custom <strong>OAuthProvider</strong> and for the AccessTokenFormat I am using a <strong>CustomJwtFormat</strong>. The <strong>OAuthProvider</strong> looks like this:</p>
  
  <pre><code>public class OAuthProvider : OAuthAuthorizationServerProvider
  {
  
      /// &lt;summary&gt;
      /// Validate client authentication
      /// &lt;/summary&gt;
      /// &lt;param name="context"&gt;The current context&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
  
          // Validate all requests (because our front end is trusted)
          context.Validated();
  
          // Return nothing
          return Task.FromResult&lt;object&gt;(null);
      }
  
      /// &lt;summary&gt;
      /// Validate user credentials
      /// &lt;/summary&gt;
      /// &lt;param name="context"&gt;The current context&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
  
          // Allow any origin
          var allowedOrigin = "*";
  
          // Add the access control allow all to our headers
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });
  
          // Get our user service
          var service = context.OwinContext.GetUserManager&lt;UserService&gt;();
  
          // Find out user
          var user = await service.FindAsync(context.UserName, context.Password);
  
          // If the user is not found
          if (user == null)
          {
  
              // Set an error
              context.SetError("invalid_grant", "The user name or password is incorrect.");
  
              // Return from the function
              return;
          }
  
          // If the user has not confirmed their account
          if (!user.EmailConfirmed)
          {
  
              // Set an error
              context.SetError("invalid_grant", "User did not confirm email.");
  
              // Return from the function
              return;
          }
  
          // Generate the identity for the user
          var oAuthIdentity = await user.GenerateUserIdentityAsync(service, "JWT");
  
          // Create a new ticket
          var ticket = new AuthenticationTicket(oAuthIdentity, null);
  
          // Add the ticked to the validated context
          context.Validated(ticket);
      }
  }
  </code></pre>
  
  <p>which is pretty straight forward. Also, the <strong>CustomJwtFormat</strong> class looks like this:</p>
  
  <pre><code>/// &lt;summary&gt;
  /// JWT Format
  /// &lt;/summary&gt;
  public class CustomJwtFormat : ISecureDataFormat&lt;AuthenticationTicket&gt;
  {
  
      // Create our private property
      private readonly string issuer;
  
      /// &lt;summary&gt;
      /// Default constructor
      /// &lt;/summary&gt;
      /// &lt;param name="issuer"&gt;The issuer&lt;/param&gt;
      public CustomJwtFormat(string issuer)
      {
          this.issuer = issuer;
      }
  
      /// &lt;summary&gt;
      /// Method to create our JWT token
      /// &lt;/summary&gt;
      /// &lt;param name="data"&gt;The Authentication ticket&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      public string Protect(AuthenticationTicket data)
      {
  
          // If no data is supplied, throw an exception
          if (data == null)
              throw new ArgumentNullException("data");
  
          // Get our values from our appSettings
          string audienceId = ConfigurationManager.AppSettings["as:AudienceId"];
          string symmetricKeyAsBase64 = ConfigurationManager.AppSettings["as:AudienceSecret"];
  
          // Decode our secret and encrypt the bytes
          var keyByteArray = TextEncodings.Base64Url.Decode(symmetricKeyAsBase64);
          var signingKey = new HmacSigningCredentials(keyByteArray);
  
          // Get our issue and expire dates in UNIX timestamps
          var issued = data.Properties.IssuedUtc;
          var expires = data.Properties.ExpiresUtc;
  
          // Create our new token
          var token = new JwtSecurityToken(this.issuer, audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey);
  
          // Create a handler
          var handler = new JwtSecurityTokenHandler();
  
          // Write our token string
          var jwt = handler.WriteToken(token);
  
          // Return our token string
          return jwt;
      }
  
      /// &lt;summary&gt;
      /// 
      /// &lt;/summary&gt;
      /// &lt;param name="protectedText"&gt;&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      public AuthenticationTicket Unprotect(string protectedText)
      {
          throw new NotImplementedException();
      }
  }
  </code></pre>
  
  <p>This is the crucial bit. It uses Thinktecture to generate the token. The line that looks like this:</p>
  
  <pre><code>// Create our new token
  var token = new JwtSecurityToken(this.issuer, audienceId, data.Identity.Claims, issued.Value.UtcDateTime, expires.Value.UtcDateTime, signingKey);
  
  // Create a handler
  var handler = new JwtSecurityTokenHandler();
  
  // Write our token string
  var jwt = handler.WriteToken(token);
  </code></pre>
  
  <p>This returns what you would expect from the token (access_token, expires_in and token_type) but I would like to return some user information too. Things like username, roles, etc.</p>
  
  <p>Anyone know how I can do this?</p>