title: Owin Bearer Token Not Working for WebApi
body: <p>I have gone through loads of documentation on this, My google search shows that I've visited all the links on the first page</p>
  
  <p><strong>Problem</strong>
  Token Generation works fine. I configured it with a custom provider as such:</p>
  
  <pre><code>    public void ConfigureOAuth(IAppBuilder app)
      {
          var usermanager = NinjectContainer.Resolve&lt;UserManager&gt;(); 
          app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
          {
              AllowInsecureHttp = true,
              TokenEndpointPath = new PathString("/token"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
              Provider = new AppOAuthProvider(usermanager)
          });
          app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions());
      }
  </code></pre>
  
  <p>However when I call a protected URL and pass the bearer token, I always get: <img src="https://i.stack.imgur.com/SLYUS.png" alt="Token Request"></p>
  
  <p>How do I diagnose or fix the problem. If possible, how can I do the token validation myself</p>
  
  <p><strong>UPDATE</strong>
  Here is my AppOAuthProvider. Both Methods are called when I'm trying to mint a token but not when I'm trying to access a protected resource</p>
  
  <pre><code>public class AppOAuthProvider : OAuthAuthorizationServerProvider
  {
      private UserManager _user;
      public AppOAuthProvider(UserManager user)
      {
          _user = user;
      }
      public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
          context.Validated();
      }
  
      public override Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
  
          //Get User Information
          var getUser = _user.FindUser(context.UserName);
          if (getUser.Status == StatusCode.Failed)
          {
              context.SetError("invalid_grant", "The user name or password is incorrect.");
              return Task.FromResult&lt;object&gt;(null);
          }
  
          var user = getUser.Result;
  
          //Get Roles for User
          var getRoles = _user.GetRoles(user.UserID);
          if (getRoles.Status == StatusCode.Failed)
          {
              context.SetError("invalid_grant", "Could not determine Roles for the Specified User");
          }
  
          var roles = getRoles.Result;
  
          var identity = new ClaimsIdentity(context.Options.AuthenticationType);
          identity.AddClaim(new Claim("UserID", user.UserID.ToString()));
          identity.AddClaim(new Claim("UserName", user.UserName));
  
          foreach (var role in roles)
          {
              identity.AddClaim(new Claim(ClaimTypes.Role, role));
          }
  
          context.Validated(identity);
  
          return Task.FromResult&lt;object&gt;(null);
      }
  }
  </code></pre>
  
  <p><strong>UPDATE 2:</strong> 
  Here is my Account Controller</p>
  
  <pre><code>[RoutePrefix("api/auth/account")]
  public class AccountController : ApiController
  {
      private UserManager _user;
      public AccountController(UserManager user)
      {
          _user = user;
      }
  
      [Authorize]
      [HttpGet]
      [Route("secret")]
      public IHttpActionResult Secret()
      {
          return Ok("Yay! Achievement Unlocked");
      }
  }
  </code></pre>
  
  <p><strong>UPDATE 3:</strong>
  Here is my Startup.cs</p>
  
  <pre><code>public partial class Startup
  {
      public void Configuration(IAppBuilder app)
      {
          app.UseNinjectMiddleware(NinjectContainer.CreateKernel);
          app.UseNinjectWebApi(GlobalConfiguration.Configuration);
          GlobalConfiguration.Configure(WebApiConfig.Register);
          ConfigureOAuth(app);
          app.UseCors(Microsoft.Owin.Cors.CorsOptions.AllowAll);
          app.UseWebApi(GlobalConfiguration.Configuration);
          app.UseWelcomePage();
      }
  }
  </code></pre>