public class OAuth2Issuer : IAuthorizationServer{private readonly IssuerConfiguration _configuration;public OAuth2Issuer(IssuerConfiguration configuration){if (configuration == null) throw new ArgumentNullException("configuration");_configuration = configuration;}public RSACryptoServiceProvider AccessTokenSigningKey{get{return (RSACryptoServiceProvider)_configuration.SigningCertificate.PrivateKey;}}public DotNetOpenAuth.Messaging.Bindings.ICryptoKeyStore CryptoKeyStore{get { throw new NotImplementedException(); }}public TimeSpan GetAccessTokenLifetime(DotNetOpenAuth.OAuth2.Messages.IAccessTokenRequest accessTokenRequestMessage){return _configuration.TokenLifetime;}public IClientDescription GetClient(string clientIdentifier){const string secretPassword = "test1243";return new ClientDescription(secretPassword, new Uri("http://localhost/"), ClientType.Confidential);}public RSACryptoServiceProvider GetResourceServerEncryptionKey(DotNetOpenAuth.OAuth2.Messages.IAccessTokenRequest accessTokenRequestMessage){return (RSACryptoServiceProvider)_configuration.EncryptionCertificate.PublicKey.Key;}public bool IsAuthorizationValid(DotNetOpenAuth.OAuth2.ChannelElements.IAuthorizationDescription authorization){//claims added to the tokenauthorization.Scope.Add("adminstrator");authorization.Scope.Add("poweruser");return true;}public bool IsResourceOwnerCredentialValid(string userName, string password){return true;}public DotNetOpenAuth.Messaging.Bindings.INonceStore VerificationCodeNonceStore{get{throw new NotImplementedException();}}}

 public class OAuth2Handler : DelegatingHandler{private readonly ResourceServerConfiguration _configuration;public OAuth2Handler(ResourceServerConfiguration configuration){if (configuration == null) throw new ArgumentNullException("configuration");_configuration = configuration;}protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken){HttpContextBase httpContext;string userName;HashSet<string> scope;if (!request.TryGetHttpContext(out httpContext))throw new InvalidOperationException("HttpContext must not be null.");var resourceServer = new ResourceServer(new StandardAccessTokenAnalyzer((RSACryptoServiceProvider)_configuration.IssuerSigningCertificate.PublicKey.Key,(RSACryptoServiceProvider)_configuration.EncryptionVerificationCertificate.PrivateKey));var error = resourceServer.VerifyAccess(httpContext.Request, out userName, out scope);if (error != null)return Task<HttpResponseMessage>.Factory.StartNew(error.ToHttpResponseMessage);var identity = new ClaimsIdentity(scope.Select(s => new Claim(s, s)));if (!string.IsNullOrEmpty(userName))identity.Claims.Add(new Claim(ClaimTypes.Name, userName));httpContext.User = ClaimsPrincipal.CreateFromIdentity(identity);Thread.CurrentPrincipal = httpContext.User;return base.SendAsync(request, cancellationToken);}}