title: Is it possible to use an external Identity Provider in a Web API with ASP.NET 5?
body: <p>Reading <a href="https://stackoverflow.com/questions/30768015/configure-the-authorization-server-endpoint">this question</a>, @Pinpoint's answer and the further discussion on comments, I'm well aware that natively we can't add an identity provider to our apps developed with ASP.NET 5. One possible replacement for the legacy OAuthAuthorizationServerMiddleware is then provided by the AspNet.Security.OpenIdConnect.Server as I've found in many places.</p>
  
  <p>Now, there is one point that I'm still unsure about all this because I'm really not an expert in security, so my knowledge about OAuth is not very deep. My doubt is the following: is it possible to use an external identity provider when using OAuth to protect one RESTful API?</p>
  
  <p>Notice that I'm <strong>not</strong> talking about adding social login to one <em>website</em>, I'm talking about using one external identity provider in one RESTful <strong>API</strong>.</p>
  
  <p>My point is, this makes me a little confused yet, because I always thought this should be a concern of my app.</p>
  
  <p>So my question here is: when using OAuth and ASP.NET 5, is it possible to use an external identity provider, other than implementing one? If it is possible, how this works in short? I mean, my app still needs to be able to manage the identities of users, in the sense that it needs to manage claims and so on.</p>
  
  <p>In that case, if it is really possible, how the flow would be? The external identity provider should issue the tokens? But how my app would be able to verify those tokens and manage users identities?</p>
  
  <p><strong>EDIT:</strong> One of the reasons I feel unsure about that is that when we use the <code>UseOAuthAuthentication</code> extension method, we set up one callback path which is described as</p>
  
  <blockquote>
    <p>The request path within the application's base path where the user-agent will be returned. The middleware will process this request when it arrives.</p>
  </blockquote>
  
  <p>Now, if we are developing a site, then this really does make sense. The person goes there, click a button to login with a provider like Facebook. The user is redirected to Facebook's page and then after he logs in, he is redirected to some page of the site.</p>
  
  <p>On the other hand, with a RESTful API this is meaningless. There is no notion of being redirected.</p>
  
  <p>This makes it seems that the usage of external providers is only for sites and not for RESTful API's. This is the main point of my question.</p>