title: How to authenticate an access token using OWIN OAuthBearerAuthentication?
body: <p><strong>What I want:<br></strong></p>
  <ol>
  <li>A token generator use OAuthAuthorizationServer and token consumer use OAuthBearerAuthentication (authenticate the access token).<br></li>
  <li>Use OWIN pipeline to manage all stuff, token stuff and web api stuff.<br></li>
  </ol>
  <p><strong>What about the code:<br></strong></p>
  <pre><code>public void Configuration(IAppBuilder app)
  {
      app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
      {
          AuthorizeEndpointPath = &quot;/Authorize&quot;,
          AllowInsecureHttp = true,
          Provider = new OAuthAuthorizationServerProvider 
          {
              OnGrantCustomExtension = GrantCustomExtension,
              OnValidateClientRedirectUri = ValidateClientRedirectUri,
              OnValidateClientAuthentication = ValidateClientAuthentication,
          }
      });
  
      app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
      {
          Provider = new OAuthBearerAuthenticationProvider 
          { 
              //Handles applying the authentication challenge to the response message.
              ApplyChallenge=MyApplyChallenge,
  
              //Handles processing OAuth bearer token.
              RequestToken=MyRequestToken,
  
              //Handles validating the identity produced from an OAuth bearer token.
              ValidateIdentity = MyValidateIdentity,
          }
      });
  
      app.UseWebApi(new WebApplication3.Config.MyWebApiConfiguration());
  }
  </code></pre>
  <p><strong>What's the question:<br></strong></p>
  <ol>
  <li><p>The 3 properties of <code>OAuthBearerAuthenticationProvider</code>,
  <code>ApplyChallenge</code>, <code>RequestToken</code> and <code>ValidateIdentity</code>. How to
  implement the 3 methods?</p>
  </li>
  <li><p>In the token authetication process, What I thought is to decrypt the access token, validate the token from the client, and if the token is validated, put the identities of the token to the <code>HttpContext.Current.User</code>.</p>
  <p>The <code>OAuthBearerAuthenticationProvider</code>'s responsibility is to fulfill the
  previous steps. Am I right?</p>
  </li>
  </ol>