title: External Owin Authentication without cookies or Local credentials
body: <p>I am working on a cross platform web app using angular and webapi. The problem is when the angular app runs in a cordova container. To play nice with the rest of the applications on the device, I am required to use a plugin for SSO.. This plugin is what is causing me issues, because it does a few things. It intercepts all the http requests and adds a bearer token to the header, which is generated by a 3rd party Token provider, so I can't decode it, and overwrites any bearer token I have set in the header.It also seems to block cookies.. </p>
  
  <p>So it makes it a bit tricky when you can't send you own local credentials.</p>
  
  <p>So I started with <a href="https://coding.abel.nu/2014/06/writing-an-owin-authentication-middleware/" rel="nofollow">https://coding.abel.nu/2014/06/writing-an-owin-authentication-middleware/</a> and <a href="http://katanaproject.codeplex.com/SourceControl/latest#src/Microsoft.Owin.Security.OAuth/OAuthBearerAuthenticationHandler.cs" rel="nofollow">http://katanaproject.codeplex.com/SourceControl/latest#src/Microsoft.Owin.Security.OAuth/OAuthBearerAuthenticationHandler.cs</a></p>
  
  <p>So I figured I should write my own middleware to take care of this; I thought since the standard oauth middleware can work without cookies, I should not have too hard a time getting my slightly different bearer token middleware to do it.. But that has not been the case... Writing my own middleware.. so I'm able to get the header, validate with the external token provider, but I can't actually sign in. </p>
  
  <pre><code>   protected override async Task&lt;AuthenticationTicket&gt; AuthenticateCoreAsync()
          {
              try
              {
                  // Find token in default location
                  string requestToken = null;
                  string authorization = Request.Headers.Get("Authorization");
                  if (!string.IsNullOrEmpty(authorization))
                  {
                      if (authorization.StartsWith("Bearer ", StringComparison.OrdinalIgnoreCase))
                      {
                          requestToken = authorization.Substring("Bearer ".Length).Trim();
                      }
                  }
  .... Take the Request token call other Server, verify token...
  </code></pre>
  
  <p>Also</p>
  
  <pre><code>    public override async Task&lt;bool&gt; InvokeAsync()
      {
           var ticket = await this.AuthenticateAsync();
           if(ticket != null)
           {
             this.Context.Authentication.SignIn(new AuthenticationProperties(), grantIdentity);
             return false;
           }
      }
  </code></pre>
  
  <p>So in the end the SignIn does not cause a error or anything, but does not actually signin. As soon as I get to a controller action with an [Authorize] attribute, I get a 401. I  not have any external cookies enabled. There is a high probability that I am on the wrong track or I am making it way too hard. </p>