title: Web API 2 OWIN Bearer token authentication - AccessTokenFormat null?
body: <p>
  I have an existing ASP.NET MVC 5 project and I'm adding a Web API 2 project to it. I want to use bearer token authentication and have followed Hongye Sun's tutorial "OWIN Bearer Token Authentication with Web API Sample" and <a href="https://stackoverflow.com/questions/19769422/net-web-api-2-owin-bearer-token-authentication">this question</a> as well.</p>
  
  <p>In my <code>Login</code> method, for the line <code>Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);</code>, the <strong>AccessTokenFormat</strong> is null. Any idea why?</p>
  
  <p>My <strong>AccountController</strong>:</p>
  
  <pre class="lang-cs prettyprint-override"><code>[RoutePrefix("api")]
  public class AccountController : ApiController
  {        
      public AccountController() {}
  
      // POST api/login
      [HttpPost]
      [Route("login")]
      public HttpResponseMessage Login(int id, string pwd)
      {
          if (id &gt; 0) // testing - not authenticating right now
          {
              var identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType);
              identity.AddClaim(new Claim(ClaimTypes.Name, id.ToString()));
              AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties());
              var currentUtc = new SystemClock().UtcNow;
              ticket.Properties.IssuedUtc = currentUtc;
              ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromMinutes(30));
              var token = Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);
              return new HttpResponseMessage(HttpStatusCode.OK)
              {
                  Content = new ObjectContent&lt;object&gt;(new
                  {
                      UserName = id.ToString(),
                      AccessToken = token
                  }, Configuration.Formatters.JsonFormatter)
              };
          }
  
          return new HttpResponseMessage(HttpStatusCode.BadRequest);
      }
  
      // POST api/token
      [Route("token")]
      [HttpPost]
      public HttpResponseMessage Token(int id, string pwd)
      {
          // Never reaches here. Do I need this method?
          return new HttpResponseMessage(HttpStatusCode.OK);
      }
  }
  </code></pre>
  
  <p><strong>Startup</strong> class:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class Startup
  {
      private static readonly ILog _log = log4net.LogManager.GetLogger(System.Reflection.MethodBase.GetCurrentMethod().DeclaringType);
      public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }
      public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }
      public static Func&lt;MyUserManager&gt; UserManagerFactory { get; set; }
      public static string PublicClientId { get; private set; }
  
      static Startup()
      {
          PublicClientId = "MyWeb";
  
          UserManagerFactory = () =&gt; new MyUserManager(new UserStore&lt;MyIdentityUser&gt;());
  
          OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
  
          OAuthOptions = new OAuthAuthorizationServerOptions
          {
              TokenEndpointPath = new PathString("/api/token"),
              Provider = new MyWebOAuthProvider(PublicClientId, UserManagerFactory),
              AuthorizeEndpointPath = new PathString("/api/login"),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              AllowInsecureHttp = true
          };
      }
  
      public void Configuration(IAppBuilder app)
      {         
          // Enable the application to use bearer tokens to authenticate users
          app.UseOAuthBearerTokens(OAuthOptions);
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
              AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
              LoginPath = new PathString("/api/login")
          });
  
          // Configure Web API to use only bearer token authentication.
          var config = GlobalConfiguration.Configuration;            
          config.SuppressDefaultHostAuthentication();
          config.Filters.Add(new HostAuthenticationFilter(OAuthBearerOptions.AuthenticationType));
  
          app.UseWebApi(config);                          
      }
  }
  </code></pre>
  
  <p><strong>MyIdentityUser</strong> just adds an extra property:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class MyIdentityUser : IdentityUser
  {
      public int SecurityLevel { get; set; }
  }
  </code></pre>
  
  <p><strong>MyUserManager</strong> calls my custom user authentication method to an internal server:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class MyUserManager : UserManager&lt;MyIdentityUser&gt;
  {
      public MyUserManager(IUserStore&lt;MyIdentityUser&gt; store) : base(store) { }
  
      public MyIdentityUser ValidateUser(int id, string pwd)
      {
          LoginIdentityUser user = null;
  
          if (MyApplication.ValidateUser(id, pwd))
          {
              // user = ??? - not yet implemented
          }
  
          return user;
      }
  }   
  </code></pre>
  
  <p><strong>MyWebOAuthProvider</strong> (I took this from the SPA template. Only <code>GrantResourceOwnerCredentials</code> has been changed):</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class MyWebOAuthProvider : OAuthAuthorizationServerProvider
  {
      private readonly string _publicClientId;
      private readonly Func&lt;MyUserManager&gt; _userManagerFactory;
  
      public MyWebOAuthProvider(string publicClientId, Func&lt;MyUserManager&gt; userManagerFactory)
      {
          if (publicClientId == null)
          {
              throw new ArgumentNullException("publicClientId");
          }
  
          if (userManagerFactory == null)
          {
              throw new ArgumentNullException("userManagerFactory");
          }
  
          _publicClientId = publicClientId;
          _userManagerFactory = userManagerFactory;
      }
  
      public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
      {
          using (MyUserManager userManager = _userManagerFactory())
          {
              MyIdentityUser user = null;
              var ctx = context as MyWebOAuthGrantResourceOwnerCredentialsContext;
  
              if (ctx != null)
              {
                  user = userManager.ValidateUser(ctx.Id, ctx.Pwd);
              }                
  
              if (user == null)
              {
                  context.SetError("invalid_grant", "The user name or password is incorrect.");
                  return;
              }
  
              ClaimsIdentity oAuthIdentity = await userManager.CreateIdentityAsync(user,
                  context.Options.AuthenticationType);
              ClaimsIdentity cookiesIdentity = await userManager.CreateIdentityAsync(user,
                  CookieAuthenticationDefaults.AuthenticationType);
              AuthenticationProperties properties = CreateProperties(user.UserName);
              AuthenticationTicket ticket = new AuthenticationTicket(oAuthIdentity, properties);
              context.Validated(ticket);
              context.Request.Context.Authentication.SignIn(cookiesIdentity);
          }
      }
  
      public override Task TokenEndpoint(OAuthTokenEndpointContext context)
      {
          ...  // unchanged from SPA template
      }
  
      public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)
      {
          ...  // unchanged from SPA template
      }
  
      public override Task ValidateClientRedirectUri(OAuthValidateClientRedirectUriContext context)
      {
          ...  // unchanged from SPA template
      }
  
      public static AuthenticationProperties CreateProperties(string userName)
      {
          ...  // unchanged from SPA template
      }
  }
  </code></pre>
  
  <p><strong>MyWebOAuthGrantResourceOwnerCredientialsContext</strong>:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class MyWebOAuthGrantResourceOwnerCredentialsContext : OAuthGrantResourceOwnerCredentialsContext
  {
      public MyWebOAuthGrantResourceOwnerCredentialsContext (IOwinContext context, OAuthAuthorizationServerOptions options, string clientId, string userName, string password, IList&lt;string&gt; scope)
          : base(context, options, clientId, userName, password, scope)
      { }
  
      public int Id { get; set; }        
      public string Pwd { get; set; }
  }
  </code></pre>
  
  <p>How is <strong>AccessTokenFormat</strong> set? Is what I've set up correct? I'm not authenticating against any external services, just a legacy internal server.
  Thanks.</p>