title: How to implement Authorization Code flow with Owin
body: <p>I'm using IdentityServer4 and trying to connect an MVC app up for authentication. I currently have things working by using the implicit flow, but I have run into the problem that my access tokens are expiring and there is no refresh token support for implicit. I also read today that implicit was designed for js apps before browsers got good, and that it is not as secure as authorization code flow.</p>
  <p>SO. I would like to get my app working with the authorization code flow. I can't find any one simple solution for this using owin. I assume there is a nice and widely automated way to have owin take care of swapping the code for an access token and all that. After extensive research online I found this snippet of code that seems to be talking about what I'm doing:</p>
  <pre><code>        app.UseOpenIdConnectAuthentication(new OpenIdConnectAuthenticationOptions
          {
              ...
              TokenValidationParameters = new TokenValidationParameters
              {
                  NameClaimType = &quot;name&quot;,
                  RoleClaimType = &quot;https://schemas.quickstarts.com/roles&quot;
              }
              ...
          });
  </code></pre>
  <p>Does anyone have any examples or other info about getting owin to do all this?</p>
  <p>Relevant info:
  IdentityServer4
  Client is .Net Framework 4.6</p>