title: ASP.NET 5 Web API supporting social logins, individual accounts, account management, authorisation screens and ASP.NET Identity. Does it exist?
body: <p>Essentially, this is an update to <a href="https://stackoverflow.com/questions/21167648/registering-web-api-2-external-logins-from-multiple-api-clients-with-owin-identi">this question</a> from nearly two years ago answered very helpfully by @Pinpoint of <code>AspNet.Security.OpenIdConnect.Server</code> fame.</p>
  
  <p>I'll just put the rant at the bottom for all who care to indulge themselves in the 4am blasphemes of a frustrated developer.</p>
  
  <p>I am starting some new projects and for my own reasons I would like to use the latest versions of ASP.NET technologies (<a href="http://www.asp.net/vnext" rel="nofollow noreferrer">ASP.NET 5 vNext</a> and MVC 6) to get going. </p>
  
  <h2>A very popular modern application architecture</h2>
  
  <ul>
  <li>Secure REST API using tokens</li>
  <li>Support for individual logins</li>
  <li>Support for social logins</li>
  </ul>
  
  <h2>Latest and greatest techy .NET stuff</h2>
  
  <ul>
  <li>ASP.NET 5 (<a href="https://github.com/aspnet/Home/wiki/Roadmap" rel="nofollow noreferrer">almost</a>..)</li>
  <li>ASP.NET Identity (with all its <a href="https://msdn.microsoft.com/en-us/library/microsoft.aspnet.identity.entityframework.identitydbcontext(v=vs.108).aspx" rel="nofollow noreferrer">user data stores</a> and <a href="http://leastprivilege.com/2015/07/22/the-state-of-security-in-asp-net-5-and-mvc-6-oauth-2-0-openid-connect-and-identityserver/" rel="nofollow noreferrer">wonderful policy stuff</a>)</li>
  <li>MVC 6</li>
  </ul>
  
  <p>Typically OAuth2 can be used for the authentication.</p>
  
  <h2>The Problem</h2>
  
  <p>ASP.NET used to support the <a href="http://www.asp.net/web-api/overview/security/individual-accounts-in-web-api" rel="nofollow noreferrer">creation of tokens with OAuth2</a>, but <a href="https://github.com/aspnet/Security/issues/83" rel="nofollow noreferrer">it doesn't any more and isn't going to</a>, and apparently <a href="http://leastprivilege.com/2014/03/24/the-web-api-v2-oauth2-authorization-server-middlewareis-it-worth-it/" rel="nofollow noreferrer">it wasn't very good anyway</a>. There is <a href="https://stackoverflow.com/questions/29048122/token-based-authentication-in-asp-net-5-vnext">some help</a>, but I'm still a little lost as to how to tie it in with ASP.NET Identity and the new <code>Authorize</code> attribute.</p>
  
  <p><strong>So onto my actual question.</strong></p>
  
  <h2>Is there a sample anywhere on this wavy, windy, scary internet that demonstrates the following:</h2>
  
  <ul>
  <li>ASP.NET 5/MVC 6 based REST API, secured with ASP.NET Identity and OAuth2, with an <code>AccountController</code> merrily creating accounts and serving tokens for social logins or individual logins, with a lovely ASP.NET Identity user store to keep things tidy, password recovery and a range of the standard, modern account stuff, and authorisation screens to confirm permissions requests ("XXX would like to access your account, is this OK?" etc.)</li>
  <li><em>(optionally)</em> Client app (I don't care if it is WPF, Cordova, AngularJS, written in assembler or running on a ZX81 with <a href="https://www.google.com/search?q=Meccano&amp;biw=1280&amp;bih=619&amp;source=lnms&amp;tbm=isch&amp;sa=X&amp;ved=0ahUKEwiL6P7c29LJAhXEaxQKHR9NBRIQ_AUIBygC#" rel="nofollow noreferrer">Meccano</a> automating the tests) that supports logging in, both socially and with individual accounts, to a REST API and gets a nice little token to fan in the air like a polaroid</li>
  </ul>
  
  <p>I've found some things that are <a href="http://cedric-dumont.com/tutorials/identityserver-v3-membershipreboot-angularjs-webapi-2-and-mvc-mix-it-introduction/" rel="nofollow noreferrer">close</a>, <a href="http://damienbod.com/2015/11/08/oauth2-implicit-flow-with-angular-and-asp-net-5-identity-server/" rel="nofollow noreferrer">closer</a> and <a href="https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/pull/104" rel="nofollow noreferrer">so on</a>. But none that match.</p>
  
  <p>As far as I understand, I can't use ASP.NET 5's new policy based authorisation stuff with <code>IdentityServer3</code>. I can't be the only human wanting this architecture, has someone accomplished this?</p>
  
  <p>I feel like each time I come to secure my app, I'm inventing the wheel a little.</p>
  
  <h1>Rant</h1>
  
  <p>I have been away from authorisation stuff for over a year, but I've come back in and boy things have changed. And it's all rather confusing with <a href="http://owin.org/" rel="nofollow noreferrer">OWIN</a>, <a href="http://katanaproject.codeplex.com/documentation" rel="nofollow noreferrer">Katana</a>, <a href="http://www.asp.net/identity" rel="nofollow noreferrer">ASP.NET Identity</a>, <a href="https://github.com/IdentityServer/IdentityServer3" rel="nofollow noreferrer">IdentityServer3</a>, <a href="https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server" rel="nofollow noreferrer">AspNet.Security.OpenIdConnect.Server</a>. It seems there are only (albeit very excellent) side projects to fully support having a .NET based secure token server. By "side projects", I mean no offence to these great projects, only that there is nothing Microsoft and/or paid supported.</p>
  
  <p>I want to get going with a whole load of development, but I am always stalled at the implementation of authentication in what I can't imagine is an unpopular architecture.</p>
  
  <p>It seems so incredible to me that such a standard architectural scenario is so deftly considered by Microsoft.</p>
  
  <p>When I want to implement logins in my REST app, I find myself upside-down and inside-out in a confusingly loud orchestra of cross firing information.</p>
  
  <p>If anyone would like to start a maintained, open source template solution, let me know. I'm fed up of the start of building REST, token based apps being so unnecessarily complex for something so basically standard.</p>