title: Authorization_code grant flow on Owin.Security.OAuth: returns invalid_grant
body: <p>I am trying to setup my authentication using the <code>authorization_code</code> grant flow. I had it previously working with <code>grant_type=password</code>, so I kind of know how the stuff is supposed to work. But when using <code>grant_type=authorization_code</code>, I couldn't make it return anything other than <code>invalid_grant</code></p>
  
  <p>Here is my setup:</p>
  
  <pre><code>app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
  {
      AllowInsecureHttp = true,
      TokenEndpointPath = new PathString("/auth/token"),
      AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(5),
      Provider = new SampleAuthProvider()
  });
  
  app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions
  {
      AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Active,
      AuthenticationType = "Bearer"
  });
  </code></pre>
  
  <p>SampleAuthProvider is the following class: <a href="https://gist.github.com/anonymous/8a0079b705423b406c00" rel="noreferrer">https://gist.github.com/anonymous/8a0079b705423b406c00</a></p>
  
  <p>Basically, it's just logging every step and validating it. I tried the request:</p>
  
  <pre><code>POST http://localhost:12345/auth/token
  grant_type=authorization_code&amp;code=xxxxxx&amp;client_id=xxxxx&amp;redirect_uri=https://xxxx.com/
  Content-Type: application/x-www-form-urlencoded
  </code></pre>
  
  <p>It's going through:</p>
  
  <ul>
  <li><code>OnMatchEndpoint</code></li>
  <li><code>OnValidateClientAuthentication</code></li>
  </ul>
  
  <p>And that's all. I expected it to call <code>OnValidateTokenRequest</code> and <code>OnGrantAuthorizationCode</code>next, but it just didn't. I have no idea why. </p>
  
  <p>The <code>xxxx</code>'s in the request aren't placeholders, I tried it like that. Maybe the middleware makes some checks on its own and rejects the request because of that? I tried variants of the <code>redirect_uri</code> with <code>http</code>, without any protocol, without trailing slash...</p>
  
  <p>It also works properly with a custom <code>grant_type</code>. It  so if I too desperate, I guess I can use that to simulate <code>authorization_code</code>, but I'd rather not have to do that.</p>
  
  <p><strong>TL;DR</strong></p>
  
  <p>My <code>OAuthAuthorizationServerProvider</code> returns <code>{"error":"invalid_grant"}</code>after <code>OnValidateClientAuthentication</code> when using <code>grant_type=authorization_code</code>.</p>
  
  <ul>
  <li>Why is it stopping there?</li>
  <li>How can I make the whole damn thing work?</li>
  </ul>
  
  <p>Thanks for your help!</p>
  
  <hr>
  
  <p><strong>Edit</strong></p>
  
  <p>As pointed out by RajeshKannan, I made a mistake in my configuration. I didn't provide an <code>AuthorizationCodeProvider</code> instance. However, that didn't completely solve the problem, since in my case, the code is not issued by the <code>AuthorizationCodeProvider</code>, and I can't just deserialize it. I anwered with the workaround I got working.</p>