public override Task ValidateClientAuthentication(OAuthValidateClientAuthenticationContext context)

        {

            string clientId = string.Empty;

            string clientSecret = string.Empty;

            Client client = null;

            if (!context.TryGetBasicCredentials(out clientId, out clientSecret))

            {

                context.TryGetFormCredentials(out clientId, out clientSecret);

            }

            if (context.ClientId == null)

            {

                //Remove the comments from the below line context.SetError, and invalidate context

                //if you want to force sending clientId/secrects once obtain access tokens.

                context.Validated();

                //context.SetError("invalid_clientId", "ClientId should be sent.");

                return Task.FromResult<object>(null);

            }

            using (AuthRepository _repo = new AuthRepository())

            {

                client = _repo.FindClient(context.ClientId);

            }

            if (client == null)

            {

                context.SetError("invalid_clientId", string.Format("Client '{0}' is not registered in the system.", context.ClientId));

                return Task.FromResult<object>(null);

            }

            if (client.ApplicationType == ApplicationTypes.NativeConfidential)

            {

                if (string.IsNullOrWhiteSpace(clientSecret))

                {

                    context.SetError("invalid_clientId", "Client secret should be sent.");

                    return Task.FromResult<object>(null);

                }

                else

                {

                    if (client.Secret != Helper.GetHash(clientSecret))

                    {

                        context.SetError("invalid_clientId", "Client secret is invalid.");

                        return Task.FromResult<object>(null);

                    }

                }

            }

            if (!client.Active)

            {

                context.SetError("invalid_clientId", "Client is inactive.");

                return Task.FromResult<object>(null);

            }

            context.OwinContext.Set<string>("as:clientAllowedOrigin", client.AllowedOrigin);

            context.OwinContext.Set<string>("as:clientRefreshTokenLifeTime", client.RefreshTokenLifeTime.ToString());

            context.Validated();

            return Task.FromResult<object>(null);

        }

/// <summary>

        /// Called when a request to the Token endpoint arrives with a "grant_type" of "password". This occurs when the user has provided name and password

        /// credentials directly into the client application's user interface, and the client application is using those to acquire an "access_token" and

        /// optional "refresh_token". If the web application supports the

        /// resource owner credentials grant type it must validate the context.Username and context.Password as appropriate. To issue an

        /// access token the context.Validated must be called with a new ticket containing the claims about the resource owner which should be associated

        /// with the access token. The application should take appropriate measures to ensure that the endpoint isn’t abused by malicious callers.

        /// The default behavior is to reject this grant type.

        /// See also http://tools.ietf.org/html/rfc6749#section-4.3.2

        /// </summary>

        /// <param name="context">The context of the event carries information in and results out.</param>

        public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)

        {

            var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin");

            if (allowedOrigin == null)

            {

                allowedOrigin = "*";

            }

            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

            //这里是验证用户名和密码，可以根据项目情况自己实现

            if (!(context.UserName == "zhangsan" && context.Password == ""))

            {

                context.SetError("invalid_grant", "The user name or password is incorrect.");

                return;

            }

            var identity = new ClaimsIdentity(context.Options.AuthenticationType);

            identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName));

            identity.AddClaim(new Claim("sub", context.UserName));

            identity.AddClaim(new Claim("role", "user"));

            var props = new AuthenticationProperties(new Dictionary<string, string>

                {

                    {

                        "as:client_id", (context.ClientId == null) ? string.Empty : context.ClientId

                    },

                    {

                        "userName", context.UserName

                    }

                });

            var ticket = new AuthenticationTicket(identity, props);

            context.Validated(ticket);

        }

        /// <summary>

        /// Called at the final stage of a successful Token endpoint request. An application may implement this call in order to do any final

        /// modification of the claims being used to issue access or refresh tokens. This call may also be used in order to add additional

        /// response parameters to the Token endpoint's json response body.

        /// </summary>

        /// <param name="context">The context of the event carries information in and results out.</param>

        /// <returns>

        /// Task to enable asynchronous execution

        /// </returns>

        public override Task TokenEndpoint(OAuthTokenEndpointContext context)

        {

            foreach (var item in context.Properties.Dictionary)

            {

                context.AdditionalResponseParameters.Add(item.Key, item.Value);

            }

            return Task.FromResult<object>(null);

        }

using System;

using System.Threading.Tasks;

using log4net;

using Microsoft.Owin.Security.Infrastructure;

using OAuthExample.Entities;

using OAuthExample.Infrastructure;

namespace OAuthExample.Providers

{

    public class CustomRefreshTokenProvider : IAuthenticationTokenProvider

    {

        private ILog logger = LogManager.GetLogger(typeof(CustomRefreshTokenProvider));

        public void Create(AuthenticationTokenCreateContext context)

        {

            throw new NotImplementedException();

        }

        /// <summary>

        /// Creates the asynchronous.

        /// </summary>

        /// <param name="context">The context.</param>

        public async Task CreateAsync(AuthenticationTokenCreateContext context)

        {

            var clientid = context.Ticket.Properties.Dictionary["as:client_id"];

            if (string.IsNullOrEmpty(clientid))

            {

                return;

            }

            //为刷新令牌生成一个唯一的标识符，这里我们使用Guid，也可以自己单独写一个字符串生成的算法

            var refreshTokenId = Guid.NewGuid().ToString("n");

            using (AuthRepository _repo = new AuthRepository())

            {

                //从Owin上下文中读取令牌生存时间，并将生存时间设置到刷新令牌

                var refreshTokenLifeTime = context.OwinContext.Get<string>("as:clientRefreshTokenLifeTime");

                var token = new RefreshToken()

                {

                    Id = Helper.GetHash(refreshTokenId),

                    ClientId = clientid,

                    Subject = context.Ticket.Identity.Name,

                    IssuedUtc = DateTime.UtcNow,

                    ExpiresUtc = DateTime.UtcNow.AddMinutes(Convert.ToDouble(refreshTokenLifeTime))

                };

                //为刷新令牌设置有效期

                context.Ticket.Properties.IssuedUtc = token.IssuedUtc;

                context.Ticket.Properties.ExpiresUtc = token.ExpiresUtc;

                //负责对票证内容进行序列化，稍后我们将次序列化字符串持久化到数据

                token.ProtectedTicket = context.SerializeTicket();

                var result = await _repo.AddRefreshToken(token);

                //在响应中文中发送刷新令牌Id

                if (result)

                {

                    context.SetToken(refreshTokenId);

                }

            }

        }

        public void Receive(AuthenticationTokenReceiveContext context)

        {

            throw new NotImplementedException();

        }

        /// <summary>

        /// Receives the asynchronous.

        /// </summary>

        /// <param name="context">The context.</param>

        /// <returns></returns>

        /// <exception cref="System.NotImplementedException"></exception>

        public async Task ReceiveAsync(AuthenticationTokenReceiveContext context)

        {

            //设置跨域访问

            var allowedOrigin = context.OwinContext.Get<string>("as:clientAllowedOrigin");

            context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });

            //获取到刷新令牌，hash后在数据库查找是否已经存在

            string hashedTokenId = Helper.GetHash(context.Token);

            using (AuthRepository _repo = new AuthRepository())

            {

                var refreshToken = await _repo.FindRefreshToken(hashedTokenId);

                if (refreshToken != null)

                {

                    //Get protectedTicket from refreshToken class

                    context.DeserializeTicket(refreshToken.ProtectedTicket);

                    //删除当前刷新令牌,然后再次生成新令牌保存到数据库

                    var result = await _repo.RemoveRefreshToken(hashedTokenId);

                }

            }

        }

    }

}

/// <summary>

        /// Called when a request to the Token endpoint arrives with a "grant_type" of "refresh_token". This occurs if your application has issued a "refresh_token"

        /// along with the "access_token", and the client is attempting to use the "refresh_token" to acquire a new "access_token", and possibly a new "refresh_token".

        /// To issue a refresh token the an Options.RefreshTokenProvider must be assigned to create the value which is returned. The claims and properties

        /// associated with the refresh token are present in the context.Ticket. The application must call context.Validated to instruct the

        /// Authorization Server middleware to issue an access token based on those claims and properties. The call to context.Validated may

        /// be given a different AuthenticationTicket or ClaimsIdentity in order to control which information flows from the refresh token to

        /// the access token. The default behavior when using the OAuthAuthorizationServerProvider is to flow information from the refresh token to

        /// the access token unmodified.

        /// See also http://tools.ietf.org/html/rfc6749#section-6

        /// </summary>

        /// <param name="context">The context of the event carries information in and results out.</param>

        /// <returns>

        /// Task to enable asynchronous execution

        /// </returns>

        public override Task GrantRefreshToken(OAuthGrantRefreshTokenContext context)

        {

            //从原始票证中读取Client Id与当前的Client Id进行比较，如果不同，将拒绝次操作请求，以保证刷新令牌生成后绑定到同一个Client

            var originalClient = context.Ticket.Properties.Dictionary["as:client_id"];

            var currentClient = context.ClientId;

            if (originalClient != currentClient)

            {

                context.SetError("invalid_clientId", "Refresh token is issued to a different clientId.");

                return Task.FromResult<object>(null);

            }

            // Change auth ticket for refresh token requests

            var newIdentity = new ClaimsIdentity(context.Ticket.Identity);

            var newClaim = newIdentity.Claims.Where(c => c.Type == "newClaim").FirstOrDefault();

            if (newClaim != null)

            {

                newIdentity.RemoveClaim(newClaim);

            }

            newIdentity.AddClaim(new Claim("newClaim", "newValue"));

            var newTicket = new AuthenticationTicket(newIdentity, context.Ticket.Properties);

            //方法执行后，代码将回到CustomRefreshTokenProvider中的"CreateAsync"方法，生成新的刷新令牌，并将其和新的访问令牌一起返回到响应中

            context.Validated(newTicket);

            return Task.FromResult<object>(null);

        }