title: How does OAuth with OWIN works in MVC5?
body: <p>I am trying to understand how OAuth work, but it feels like one big magic show, and I don't like that.</p>
  
  <p>I have created a new MVC5 project and enabled facebook authentication. This all just works fine, however, I am trying to understand how this works.</p>
  
  <p>Here is the part where I get lost. Imagine a user wants to log in for the very first time. This method is the executed:</p>
  
  <pre><code>    public async Task&lt;ActionResult&gt; ExternalLoginCallback(string returnUrl)
      {
          var loginInfo = await AuthenticationManager.GetExternalLoginInfoAsync();
          if (loginInfo == null)
          {
              return RedirectToAction("Login");
          }
  
          // Sign in the user with this external login provider if the user already has a login
          var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);
          switch (result)
          {
              case SignInStatus.Success:
                  return RedirectToLocal(returnUrl);
              case SignInStatus.LockedOut:
                  return View("Lockout");
              case SignInStatus.RequiresVerification:
                  return RedirectToAction("SendCode", new { ReturnUrl = returnUrl, RememberMe = false });
              case SignInStatus.Failure:
              default:
                  // If the user does not have an account, then prompt the user to create an account
                  ViewBag.ReturnUrl = returnUrl;
                  ViewBag.LoginProvider = loginInfo.Login.LoginProvider;
                  return View("ExternalLoginConfirmation", new ExternalLoginConfirmationViewModel { Email = loginInfo.Email });
          }
      }
  </code></pre>
  
  <p>This code shows the FB login page and FB will take care of the credentials. This all works fine. But then, this line is executed: <code>var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);</code>. I can see in <code>loginInfo</code> that a name is set, but the <code>result</code> variabel is set to <code>Failure</code>. Why is that? The user has just been authenticated by FB, so why is the value <code>false</code>?</p>
  
  <p>But then, for my feeling it gets weirder. When I continue to run the sample application, it asks for me to enter an e-mail address. I enter an e-mail address and voila, I am logged in. Since I am exploring this whole login thing, I log off and I want to log in again. So, I log off and immediatly log in again using FB. And here is where I bang my head against the wall. When the code hits this line again: <code>var result = await SignInManager.ExternalSignInAsync(loginInfo, isPersistent: false);</code> the result is set to <code>true</code>!!</p>
  
  <p>Could someone please explain to me what's all going on here??</p>