title: what function does OWIN exactly use to generate a token; Can it be leveraged?
body: <p>I can see the way to generate tokens using the following code
   as outlined in </p>
  
  <p><a href="http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/" rel="nofollow">http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/</a></p>
  
  <pre><code>OAuthAuthorizationServerOptions OAuthServerOptions = new OAuthAuthorizationServerOptions()
  {
      AllowInsecureHttp = true,
      TokenEndpointPath = new PathString("/token"),
      AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
      Provider = new SimpleAuthorizationServerProvider()
  };
  
  // Token Generation
  app.UseOAuthAuthorizationServer(OAuthServerOptions);
  
  var bearerAuth = new OAuthBearerAuthenticationOptions()
  {
      Provider = new OAuthBearerAuthenticationProvider()
  };
  
  app.UseOAuthBearerAuthentication(bearerAuth);
  
  
  public class SimpleAuthorizationServerProvider : OAuthAuthorizationServerProvider
  {
  
  
      public override async Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
          context.Validated();
      }
  
      public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
  
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { "*" });
  
          var manager = new UserManager&lt;User, long&gt;(new UserStore(new UserRepository()));
          var user = await manager.FindAsync(context.UserName, context.Password);
  
          if (user == null)
          {
              context.SetError("invalid_grant", "The user name or password is incorrect.");
          }
          else
          {
              var identity = new ClaimsIdentity(context.Options.AuthenticationType);
              identity.AddClaim(new Claim("name",user.Email));
              context.Validated(identity);
          }
  
  
      }
  }
  </code></pre>
  
  <p>As a consumer I make a REST call to <a href="http://localhost:9000/token" rel="nofollow">http://localhost:9000/token</a> with my credentials and <code>magically</code> get an access token</p>
  
  <p>I would like to be able to leverage that token generation function for use in other scenarios to manually create a token that would be valid for <code>**this particular**</code> OWIN server.</p>
  
  <p>Secondly, is it possible to have multiple authorization providers that can be conditionally used by this server. If so how does one do that without implementing a token generator from scratch (like the external login stuff)?  </p>