title: Oauth Implicit Grant web api authorization server
body: <p>I am looking at the following example for the implicit grant.</p>
  
  <p><a href="http://code.msdn.microsoft.com/OWIN-OAuth-20-Authorization-ba2b8783" rel="nofollow">http://code.msdn.microsoft.com/OWIN-OAuth-20-Authorization-ba2b8783</a></p>
  
  <p>I can see how the example is redirecting unauthenticated user to the same authorization serer's log in page. which is something like follows:</p>
  
  <pre><code>Client ---&gt; AuthServer ---&gt; 401
                               |
         &lt;--- Login (UI) &lt;------
              (On Auth server)           
  </code></pre>
  
  <p>My problem is that I dont want to authorization server to handle UI part of login page. That is my authorization server is a web api and its only job is to process the owin pipeline and authenticate user via webapi.</p>
  
  <p>So ideally what I would like to do is, that authorization server respond with 401 to the client. Client (could pure js app) show login page (username/password) and POST to authorization server with username/password over SSL and auth. server says you are ok to login.</p>
  
  <p>This will give all the client to manage Look and feel of their login page but the authentication (logic) part is done via auth server webapi.</p>
  
  <p>Is this possible?
  Are there any security implication that I need to be aware of when implementing this (only specific to this scenario) ?</p>
  
  <p>Thanks</p>