title: HTTP 500 using OAuthAuthentication with Azure Active Directory to secure ASP.NET 5 Web API
body: <p>For context, I have OpenIdConnect with an ASP.NET 4 Web App working using Owin (and a lot of help from <a href="https://rads.stackoverflow.com/amzn/click/com/B019HUF7D8" rel="nofollow noreferrer" rel="nofollow noreferrer">Modern Authentication with Azure Active Directory for Web Applications</a>.</p>
  
  <p>I now want to secure a separate ASP.NET 5 Web API project (to be hosted in the same AD tenant in Azure as a microservice).  I started with the simple ASP.NET 5 WebApi generated in Visual Studio and added the following to the Configure in Startup.cs (at the beginning of the pipeline):</p>
  
  <pre class="lang-cs prettyprint-override"><code>app.UseOAuthAuthentication(new OAuthOptions()
  {
      ClientId = "71d33a1c-505c-4815-a790-8494dd2bb430",
      ClientSecret = "LajQFbf1/Nyt/6zCP5vE5YWj5VC4aNaC3i/SRtEj2sI=",
      TokenEndpoint = "https://login.microsoftonline.com/7058f4f0-619f-4c16-ac31-9e209d70ff23/oauth2/token",
      AuthorizationEndpoint = "https://login.microsoftonline.com/7058f4f0-619f-4c16-ac31-9e209d70ff23/oauth2/authorize",
      AuthenticationScheme = "OAuth2Bearer",
      CallbackPath = "/api/values"
  });
  </code></pre>
  
  <p>This gives me an error that indicates <code>SignInScheme</code> must be provided, but I'm not clear on what that value should be. If I add in a string, say <strong>"OAuth2Bearer"</strong>, I get further, but still get a 500 error on the request, but no exception raised in the API app, nor does the breakpoint on the first line in my API controller implementation get hit.</p>
  
  <p>What am I missing?  Ideally, I want to then extend the Events of OAuthOptions to add a custom claim, analogous to what I did with OpenIdConnect and the SecurityTokenValidated notification.</p>