title: Microsoft Owin Don't want to use implicit flow
body: <p>I am trying to get Owin working in an asp.net web app with Azure AD.  Here is my startup code that configures Owin.</p>
  <pre><code>    public class Startup
  {
      // The Client ID is used by the application to uniquely identify itself to Microsoft identity platform.
      string clientId = System.Configuration.ConfigurationManager.AppSettings[&quot;ClientId&quot;];
  
      // RedirectUri is the URL where the user will be redirected to after they sign in.
      string redirectUri = System.Configuration.ConfigurationManager.AppSettings[&quot;RedirectUri&quot;];
  
      // Tenant is the tenant ID (e.g. contoso.onmicrosoft.com, or 'common' for multi-tenant)
      static string tenant = System.Configuration.ConfigurationManager.AppSettings[&quot;Tenant&quot;];
  
      // Authority is the URL for authority, composed by Microsoft identity platform endpoint and the tenant name (e.g. https://login.microsoftonline.com/contoso.onmicrosoft.com/v2.0)
      string authority = String.Format(System.Globalization.CultureInfo.InvariantCulture, System.Configuration.ConfigurationManager.AppSettings[&quot;Authority&quot;], tenant);
  
      /// &lt;summary&gt;
      /// Configure OWIN to use OpenIdConnect
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;app&quot;&gt;&lt;/param&gt;
      public void Configuration(IAppBuilder app)
      {
          app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
  
          app.UseCookieAuthentication(new CookieAuthenticationOptions());
          app.UseOpenIdConnectAuthentication(
              new OpenIdConnectAuthenticationOptions
              {
              // Sets the ClientId, authority, RedirectUri as obtained from web.config
              ClientId = clientId,
                  Authority = authority,
                  RedirectUri = redirectUri,
              // PostLogoutRedirectUri is the page that users will be redirected to after sign-out. In this case, it is using the home page
              PostLogoutRedirectUri = redirectUri,
                  Scope = OpenIdConnectScope.OpenIdProfile,
              // ResponseType is set to request the id_token - which contains basic information about the signed-in user
              ResponseType = OpenIdConnectResponseType.IdToken,
              // ValidateIssuer set to false to allow personal and work accounts from any organization to sign in to your application
              // To only allow users from a single organizations, set ValidateIssuer to true and 'tenant' setting in web.config to the tenant name
              // To allow users from only a list of specific organizations, set ValidateIssuer to true and use ValidIssuers parameter
              TokenValidationParameters = new TokenValidationParameters()
                  {
                      ValidateIssuer = false // This is a simplification
              },
              // OpenIdConnectAuthenticationNotifications configures OWIN to send notification of failed authentications to OnAuthenticationFailed method
              Notifications = new OpenIdConnectAuthenticationNotifications
                  {
                      AuthenticationFailed = OnAuthenticationFailed,
                      MessageReceived = OnMessageReceived
                  }
              }
          );
      }
  
      /// &lt;summary&gt;
      /// Handle failed authentication requests by redirecting the user to the home page with an error in the query string
      /// &lt;/summary&gt;
      /// &lt;param name=&quot;context&quot;&gt;&lt;/param&gt;
      /// &lt;returns&gt;&lt;/returns&gt;
      private Task OnAuthenticationFailed(AuthenticationFailedNotification&lt;OpenIdConnectMessage, OpenIdConnectAuthenticationOptions&gt; context)
      {
          context.HandleResponse();
          context.Response.Redirect(&quot;/?errormessage=&quot; + context.Exception.Message);
          return Task.FromResult(0);
      }
  
      private Task OnMessageReceived(MessageReceivedNotification&lt;OpenIdConnectMessage, OpenIdConnectAuthenticationOptions&gt; notification)
      {
          string tmp = notification.ProtocolMessage.ErrorDescription;
          return Task.FromResult(0);
      }
  }
  </code></pre>
  <p>This code does not work unless I enable implicit flow in Azure AD.  I don't want to use implicit flow because of security reasons. I would rather use authorization flow.  What changes do I need to make, so that this code will work without enable implicit flow in Azure?</p>