title: Web API token authentication with a custom user database
body: <p>I am developing a Web API 2.1 service that needs to authenticate the connecting clients (HTML5/JS clients that I will create and control). Unfortunately, the user information (username, password hashes, roles and much, much more info) is stored in an existing (SQL Server) database to which I only have read access. The Users database table was created 5-6 years ago without any reference to security frameworks, so it's a completely custom format. I'm not allowed to make any changes to either the data or the database structure.</p>
  
  <p>Inspired by <a href="http://www.codeproject.com/Articles/630986/Cross-Platform-Authentication-With-ASP-NET-Web-API" rel="nofollow noreferrer">this article</a>, I rolled my own token-based method of authenticating users, but I'm lacking the completeness and (re)assurance of using an established security framework.</p>
  
  <p>Is there a way to integrate an existing framework, e.g. OAuth2, within my current project given the constraints I mentioned above? I don't know if it makes any difference, but I'm self-hosting using OWIN.</p>