title: How can I use OWIN to authenticate with OpenID Connect directly with a token
body: <p>I have an MVC web application that uses OWIN / openid connect to authenticate users with <a href="https://login.windows.net/common/" rel="nofollow">https://login.windows.net/common/</a>. It's based on the azure / office 365 sample here: <a href="https://github.com/OfficeDev/Research-Project-Code-Sample" rel="nofollow">https://github.com/OfficeDev/Research-Project-Code-Sample</a>.</p>
  
  <p>If I understand the authentication flow correctly it goes like this:</p>
  
  <ol>
  <li>the app checks (based on a cookie) if there is already an authenticated user</li>
  <li>if not, then it redirects to the providers authorization page (login.microsoftonline.com)</li>
  <li>the page redirects back to my app with an auth code</li>
  <li>My app calls the provider again with the auth code for an access token (or is it an id_token?)</li>
  <li>My app (the OWIN component) extracts the various openid properties and sets them on the threads current principal</li>
  </ol>
  
  <p>That works fine.</p>
  
  <p>Now I want my MVC application to call my Web API application. The Web API application is never called directly by the browser but always by the MVC client. The Web API application doesn't use cookies and can't redirect if a request is made with incorrect or stale authentication info. The Web API application should be able to be called with the authentication token that the MVC application got and use this to set a ClaimsPrincipal on the executing thread. An alternative might be for me to use some custom solution in the MVC app for encrypting the user info and sending it on to the Web API, but this would be a last resort. I would much prefer to use standard owin.</p>