public class AppStoreUser : IdentityUser
{...
}

public class AppStoreUserConfiguraiton : EntityTypeConfiguration<AppStoreUser>
{public AppStoreUserConfiguration(){ToTable("Users");}
}

public class StoreContext : IdentityDbContext<AppStoreUser>
{public StoreContext() : base("StoreContext", thrwoIfVISchema: false){protected override void OnModelCreating(DbModelBuilder modelBuilder){modelBuilder.Entity<IdentityUserLogin>().HasKey<string>(l => l.UserId);modelBuilder.Entity<IdentityRole>().HasKey<string>(r => r.Id);modelBuilder.Entity<IdentityUserRole>().HasKey(r => new { r.RoleId, r.UserId });modelBuilder.Configurations.Add(new AppStoreUserConfiguration());modelBuilder.Configurations.Add(new CategoryConfiguration());modelBuilder.Configurations.Add(new OrderConfiguration());}      }
}

public class AppStoreUserManager : UserManager<AppStoreUser>
{public AppStoreUserManager(IUserStore<AppStoreUser> store) : base(store){}
}

[assembly: OwinStartup(typeof(Store.Startup))]
namespace Store
{public partial class Startup{public void Configuration(IAppBuilder app){ConfigureStoreAuthentication(app);}}
}

//启用OWIN的Bearer Token Authentication
public partial class Startup
{public static OAuthAuthorizationServerOptions OAuthOptions { get; private set; }public static string PublicClientId { get; private set; }public void ConfigureStoreAuthentication(IAppBuilder app){// User a single instance of StoreContext and AppStoreUserManager per request
        app.CreatePerOwinContext(StoreContext.Create);app.CreatePerOwinContext<AppStoreUserManager>(AppStoreUserManager.Create);// Configure the application for OAuth based flowPublicClientId = "self";OAuthOptions = new OAuthAuthorizationServerOptions{TokenEndpointPath = new PathString("/Token"),Provider = new ApplicationOAuthProvider(PublicClientId),AccessTokenExpireTimeSpan = TimeSpan.FromDays(10),AllowInsecureHttp = true};app.UseOAuthBearerTokens(OAuthOptions);}
}

public class AppStoreUserManager : UserManager<AppStoreUser>
{public AppStoreUserManager(IUserStore<AppStoreUser> store): base(store){}public static AppStoreUserManager Create(IdentityFactoryOptions<AppStoreUserManager> options, IOwinContext context){var manager = new AppStoreUserManager(new UserStore<AppStoreUser>(context.Get<StoreContext>()));// Configure validation logic for usernamesmanager.UserValidator = new UserValidator<AppStoreUser>(manager){AllowOnlyAlphanumericUserNames = false,RequireUniqueEmail = true};// Password Validationsmanager.PasswordValidator = new PasswordValidator{RequiredLength = 6,RequireNonLetterOrDigit = false,RequireDigit = false,RequireLowercase = true,RequireUppercase = true,};var dataProtectionProvider = options.DataProtectionProvider;if (dataProtectionProvider != null){manager.UserTokenProvider = new DataProtectorTokenProvider<AppStoreUser>(dataProtectionProvider.Create("ASP.NET Identity"));}return manager;}public async Task<ClaimsIdentity> GenerateUserIdentityAsync(AppStoreUser user, string authenticationType){var userIdentity = await CreateIdentityAsync(user, authenticationType);return userIdentity;}
}

Request.GetOwinContext().GetUserManager<AppStoreUserManager>();

public class ApplicationOAuthProvider : OAuthAuthorizationServerProvider
{private readonly string _publicClientId;public ApplicationOAuthProvider(string publicClientId){if (publicClientId == null){throw new ArgumentNullException("publicClientId");}_publicClientId = publicClientId;}public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context){var userManager = context.OwinContext.GetUserManager<AppStoreUserManager>();AppStoreUser user = await userManager.FindAsync(context.UserName, context.Password);if (user == null){context.SetError("invalid_grant", "Invalid username or password.");return;}ClaimsIdentity oAuthIdentity = await userManager.GenerateUserIdentityAsync(user, OAuthDefaults.AuthenticationType);AuthenticationProperties properties = new AuthenticationProperties(); AuthenticationTicket ticket = new AuthenticationTicket(oAuthIdentity, properties);context.Validated(ticket);}public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context){if (context.ClientId == null){context.Validated();}return Task.FromResult<object>(null);}
}

public static class WebApiConfig
{public static void Register(HttpConfiguration config){// Web API configuration and services// Configure Web API to use only bearer token authentication.
        config.SuppressDefaultHostAuthentication();config.Filters.Add(new HostAuthenticationFilter(OAuthDefaults.AuthenticationType));// Web API routes
        config.MapHttpAttributeRoutes();}
}

[Authorize]
public class OrdersController : ApiController
{}

[Authorize]
[RoutePrefix("api/Account")]
public class AccountController : ApiController
{//private const string LocalLoginProvider = "Local";private AppStoreUserManager _userManager;public AccountController(){}public AccountController(AppStoreUserManager userManager,ISecureDataFormat<AuthenticationTicket> accessTokenFormat){UserManager = userManager;AccessTokenFormat = accessTokenFormat;}public AppStoreUserManager UserManager{get{return _userManager ?? Request.GetOwinContext().GetUserManager<AppStoreUserManager>();}private set{_userManager = value;}}public ISecureDataFormat<AuthenticationTicket> AccessTokenFormat { get; private set; }// POST api/Account/Register
    [AllowAnonymous][Route("Register")]public async Task<IHttpActionResult> Register(RegistrationModel model){if (!ModelState.IsValid){return BadRequest(ModelState);}var user = new AppStoreUser() { UserName = model.Email, Email = model.Email };IdentityResult result = await UserManager.CreateAsync(user, model.Password);if (!result.Succeeded){return GetErrorResult(result);}return Ok();}protected override void Dispose(bool disposing){if (disposing && _userManager != null){_userManager.Dispose();_userManager = null;}base.Dispose(disposing);}#region Helpersprivate IAuthenticationManager Authentication{get { return Request.GetOwinContext().Authentication; }}private IHttpActionResult GetErrorResult(IdentityResult result){if (result == null){return InternalServerError();}if (!result.Succeeded){if (result.Errors != null){foreach (string error in result.Errors){ModelState.AddModelError("", error);}}if (ModelState.IsValid){// No ModelState errors are available to send, so just return an empty BadRequest.return BadRequest();}return BadRequest(ModelState);}return null;}#endregion
}

angular.module('gadgetsStore').constant('gadgetsUrl', 'http://localhost:61691/api/gadgets').constant('ordersUrl', 'http://localhost:61691/api/orders').constant('categoriesUrl', 'http://localhost:61691/api/categories').constant('tempOrdersUrl', 'http://localhost:61691/api/sessions/temporders').constant('registerUrl', '/api/Account/Register').constant('tokenUrl', '/Token').constant('tokenKey', 'accessToken').controller('gadgetStoreCtrl', function ($scope, $http, $location, gadgetsUrl, categoriesUrl, ordersUrl, tempOrdersUrl, cart, tokenKey) {

$scope.sendOrder = function (shippingDetails) {var token = sessionStorage.getItem(tokenKey);console.log(token);var headers = {};if (token) {headers.Authorization = 'Bearer ' + token;}var order = angular.copy(shippingDetails);order.gadgets = cart.getProducts();$http.post(ordersUrl, order, { headers: { 'Authorization': 'Bearer ' + token } }).success(function (data, status, headers, config) {$scope.data.OrderLocation = headers('Location');$scope.data.OrderID = data.OrderID;cart.getProducts().length = 0;$scope.saveOrder();$location.path("/complete");}).error(function (data, status, headers, config) {if (status != 401)$scope.data.orderError = data.Message;else {$location.path("/login");}}).finally(function () {});
}

$scope.logout = function () {sessionStorage.removeItem(tokenKey);
}
$scope.createAccount = function () {$location.path("/register");
}

 $routeProvider.when("/login", {templateUrl: "app/views/login.html"});
$routeProvider.when("/register", {templateUrl: "app/views/register.html"});

angular.module("gadgetsStore").controller('accountController', function ($scope, $http, $location, registerUrl, tokenUrl, tokenKey) {$scope.hasLoginError = false;$scope.hasRegistrationError = false;// Registration$scope.register = function () {$scope.hasRegistrationError = false;$scope.result = '';var data = {Email: $scope.registerEmail,Password: $scope.registerPassword,ConfirmPassword: $scope.registerPassword2};$http.post(registerUrl, JSON.stringify(data)).success(function (data, status, headers, config) {$location.path("/login");}).error(function (data, status, headers, config) {$scope.hasRegistrationError = true;var errorMessage = data.Message;console.log(data);$scope.registrationErrorDescription = errorMessage;if (data.ModelState['model.Email'])$scope.registrationErrorDescription += data.ModelState['model.Email'];if (data.ModelState['model.Password'])$scope.registrationErrorDescription += data.ModelState['model.Password'];if (data.ModelState['model.ConfirmPassword'])$scope.registrationErrorDescription += data.ModelState['model.ConfirmPassword'];if (data.ModelState[''])$scope.registrationErrorDescription +=  data.ModelState[''];}).finally(function () {});}$scope.login = function () {$scope.result = '';var loginData = {grant_type: 'password',username: $scope.loginEmail,password: $scope.loginPassword};$http({method: 'POST',url: tokenUrl,data: $.param(loginData),headers: {'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'}}).then(function (result) {console.log(result);$location.path("/submitorder");sessionStorage.setItem(tokenKey, result.data.access_token);$scope.hasLoginError = false;$scope.isAuthenticated = true;}, function (data, status, headers, config) {$scope.hasLoginError = true;$scope.loginErrorDescription = data.data.error_description;});}});

<div ng-controller="accountController"><form role="form"><input name="email" type="email" ng-model="loginEmail" autofocus=""><input  name="password" type="password" ng-model="loginPassword" value=""><div ng-show="hasLoginError"><a href="#" ng-bind="loginErrorDescription"></a></div><a href="" ng-click="login()">Login</a><a href="" ng-click="createAccount()">Create account</a></form>
</div>

<div ng-controller="accountController"><form role="form"><input name="email" type="email" ng-model="registerEmail" autofocus=""><input name="password" type="password" ng-model="registerPassword" value=""><input name="confirmPassword" type="password" ng-model="registerPassword2" value=""><div ng-show="hasRegistrationError"><a href="#" ng-bind="registrationErrorDescription"></a></div><a href="" ng-click="register()">Create account</a</form>
</div>

<a href="" ng-show="isUserAuthenticated()" ng-click="logout()">Logout</a>

angular.module("gadgetsStore").service('accountService', function ($http, registerUrl, tokenUrl, tokenKey) {this.register = function (data) {var request = $http.post(registerUrl, data);return request;}this.generateAccessToken = function (loginData) {var requestToken = $http({method: 'POST',url: tokenUrl,data: $.param(loginData),headers: {'Content-Type': 'application/x-www-form-urlencoded; charset=UTF-8'}});return requestToken;}this.isUserAuthenticated = function () {var token = sessionStorage.getItem(tokenKey);if (token)return true;elsereturn false;}this.logout = function () {sessionStorage.removeItem(tokenKey);}});

angular.module("gadgetsStore").service('storeService', function ($http, gadgetsUrl, categoriesUrl, tempOrdersUrl, ordersUrl, tokenKey) {this.getGadgets = function () {var request = $http.get(gadgetsUrl);return request;}this.getCategories = function () {var request = $http.get(categoriesUrl);return request;}this.submitOrder = function (order) {var token = sessionStorage.getItem(tokenKey);console.log(token);var headers = {};if (token) {headers.Authorization = 'Bearer ' + token;}var request = $http.post(ordersUrl, order, { headers: { 'Authorization': 'Bearer ' + token } });return request;}this.saveTempOrder = function (currentProducts) {var request = $http.post(tempOrdersUrl, currentProducts);return request;}this.loadTempOrder = function () {var request = $http.get(tempOrdersUrl);return request;}});