oidc

Yavsc/Views/Shared/Authorize.cshtml

@@ -1,18 +1,18 @@
 @using AspNet.Security.OpenIdConnect.Extensions
 @using Microsoft.IdentityModel.Protocols.OpenIdConnect
-@using Mvc.Server.Models
 
-@model Tuple<OpenIdConnectMessage, Application>
+
+@model AuthorisationView
 
 <div class="jumbotron">
     <h1>Authorization</h1>
 
-    <p class="lead text-left">Do you wanna grant <strong>@Model.Item2.DisplayName</strong> an access to your resources? (scopes requested: @Model.Item1.Scope)</p>
+    <p class="lead text-left">Do you wanna grant <strong>@Model.Application.DisplayName</strong> an access to your resources? (scopes requested: @Model.Message.Scope)</p>
 
     <form enctype="application/x-www-form-urlencoded" method="post">
         @Html.AntiForgeryToken()
 
-        @foreach (var parameter in Model.Item1.Parameters) {
+        @foreach (var parameter in Model.Message.Parameters) {
             <input type="hidden" name="@parameter.Key" value="@parameter.Value" />
         }
 

Yavsc/Views/Shared/Forbidden.cshtml

@@ -0,0 +1,3 @@
+@model string
+
+Accès interdit : @model

Yavsc/omnisharp.json

@@ -0,0 +1,6 @@
+{
+    "dotnet": {
+        "projects": "*/project.json",
+        "enablePackageRestore": false
+    }
+}

Yavsc/project.json

@@ -58,15 +58,15 @@
     "Microsoft.AspNet.IISPlatformHandler": "1.0.0-rc1-*",
     "Microsoft.AspNet.Mvc": "6.0.0-rc1-*",
     "Microsoft.AspNet.Mvc.TagHelpers": "6.0.0-rc1-*",
-    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-*",
+    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-final",
     "Microsoft.AspNet.StaticFiles": "1.0.0-rc1-*",
     "Microsoft.AspNet.Tooling.Razor": "1.0.0-rc1-*",
     "Microsoft.Extensions.Configuration.FileProviderExtensions": "1.0.0-rc1-*",
     "Microsoft.Extensions.Configuration.Json": "1.0.0-rc1-*",
     "Microsoft.Extensions.Configuration.Abstractions": "1.0.0-rc1-final",
     "Microsoft.Extensions.Configuration.UserSecrets": "1.0.0-rc1-*",
-    "Microsoft.Extensions.Logging": "1.0.0-rc1-*",
-    "Microsoft.Extensions.Logging.Console": "1.0.0-rc1-*",
+    "Microsoft.Extensions.Logging": "1.0.0-rc1-final",
+    "Microsoft.Extensions.Logging.Console": "1.0.0-rc1-final",
     "Microsoft.Extensions.Logging.Debug": "1.0.0-rc1-final",
     "Microsoft.Framework.DependencyInjection": "1.0.0-beta8",
     "Microsoft.Extensions.DependencyInjection.Abstractions": "1.0.0-rc1-final",
@@ -110,8 +110,8 @@
     "Microsoft.AspNet.DataProtection": "1.0.0-rc1-final",
     "Microsoft.AspNet.DataProtection.SystemWeb": "1.0.0-rc1-final",
     "Microsoft.AspNet.Authentication.JwtBearer": "1.0.0-rc1-final",
-    "System.IdentityModel.Tokens": "5.0.0-rc1-208241120",
-    "System.IdentityModel.Tokens.Jwt": "5.0.0-rc1-208241120",
+    "System.IdentityModel.Tokens": "5.0.0-rc1-211161024",
+    "System.IdentityModel.Tokens.Jwt": "5.0.0-rc1-211161024",
     "Microsoft.AspNet.Authorization": "1.0.0-rc1-final",
     "AspNet.Security.OpenIdConnect.Server": "1.0.0-beta4"
   },

Yavsc/src/Controllers/AccountController.cs

@@ -136,7 +136,6 @@ namespace Yavsc.Controllers
         [ValidateAntiForgeryToken]
         public async Task<IActionResult> LogOff(string returnUrl = null)
         {
-            await HttpContext.Authentication.SignOutAsync("ServerCookie");
             await _signInManager.SignOutAsync();
             _logger.LogInformation(4, "User logged out.");
             if (returnUrl==null) return RedirectToAction(nameof(HomeController.Index), "Home");

Yavsc/src/Controllers/BlogspotController.cs

@@ -92,14 +92,14 @@ namespace Yavsc.Controllers
         }
 
         // GET: Blog/Create
-        [Authorize("Authenticated")]
+        [Authorize()]
         public IActionResult Create()
         {
             return View();
         }
 
         // POST: Blog/Create
-        [HttpPost, Authorize("Authenticated"), ValidateAntiForgeryToken]
+        [HttpPost, Authorize(), ValidateAntiForgeryToken]
         public IActionResult Create(Blog blog)
         {
             blog.modified = blog.posted = DateTime.Now;
@@ -117,7 +117,7 @@ namespace Yavsc.Controllers
             _logger.LogWarning("Invalid Blog posted ...");
             return View(blog);
         }
-        [Authorize("Authenticated")]
+        [Authorize()]
         // GET: Blog/Edit/5
         public async Task<IActionResult> Edit(long? id)
         {
@@ -143,7 +143,7 @@ namespace Yavsc.Controllers
 
         // POST: Blog/Edit/5
         [HttpPost]
-        [ValidateAntiForgeryToken,Authorize("Authenticated")]
+        [ValidateAntiForgeryToken,Authorize()]
         public IActionResult Edit(Blog blog)
         {
             if (ModelState.IsValid)
@@ -166,7 +166,7 @@ namespace Yavsc.Controllers
         }
 
         // GET: Blog/Delete/5
-        [ActionName("Delete"),Authorize("Authenticated")]
+        [ActionName("Delete"),Authorize()]
         public IActionResult Delete(long? id)
         {
             if (id == null)
@@ -186,7 +186,7 @@ namespace Yavsc.Controllers
         }
 
         // POST: Blog/Delete/5
-        [HttpPost, ActionName("Delete"), Authorize("Authenticated")]
+        [HttpPost, ActionName("Delete"), Authorize()]
         [ValidateAntiForgeryToken]
         public IActionResult DeleteConfirmed(long id)
         {

Yavsc/src/Controllers/OAuthController.cs

@@ -26,6 +26,8 @@ namespace Yavsc.Controllers
     {
         ApplicationDbContext _context;
         UserManager<ApplicationUser> _userManager;
+        
+        SiteSettings _siteSettings;
 
         ILogger _logger;
         private readonly SignInManager<ApplicationUser> _signInManager;
@@ -34,9 +36,11 @@ namespace Yavsc.Controllers
         public OAuthController(ApplicationDbContext context, SignInManager<ApplicationUser> signInManager, IKeyManager keyManager,
         IOptions<TokenAuthOptions> tokenOptions,
         UserManager<ApplicationUser> userManager,
+        IOptions<SiteSettings> siteSettings,
         ILoggerFactory loggerFactory
         )
         {
+            _siteSettings = siteSettings.Value;
             _context = context;
             _signInManager = signInManager;
             _tokenOptions = tokenOptions.Value;
@@ -48,6 +52,7 @@ namespace Yavsc.Controllers
         [HttpGet("~/signin")]
         public ActionResult SignIn(string returnUrl = null, string target = null)
         {
+            _logger.LogWarning($"Singin wanted: returnUrl: {returnUrl} target: {target}");
             // Note: the "returnUrl" parameter corresponds to the endpoint the user agent
             // will be redirected to after a successful authentication and not
             // the redirect_uri of the requesting client application.
@@ -72,7 +77,7 @@ namespace Yavsc.Controllers
         [HttpGet("~/forbidden")]
         public ActionResult Forbidden(string returnUrl = null)
         {
-            return SignIn("/Account/ExternalLoginCallback",returnUrl);
+            return View(returnUrl);
         }
         
         [HttpPost("~/signin")]
@@ -200,11 +205,12 @@ namespace Yavsc.Controllers
                     })
                 });
             }
-
             // Note: ASOS automatically ensures that an application corresponds to the client_id specified
             // in the authorization request by calling IOpenIdConnectServerProvider.ValidateAuthorizationRequest.
             // In theory, this null check shouldn't be needed, but a race condition could occur if you
             // manually removed the application details from the database after the initial check made by ASOS.
+            /* FIXME response.ClientId && request.ClientId are null or empty here */
+            _logger.LogInformation($"ensures that an application corresponds to the client_id specified ({request.ClientId})");
             var application = await GetApplicationAsync(request.ClientId, cancellationToken);
             if (application == null)
             {
@@ -217,10 +223,10 @@ namespace Yavsc.Controllers
             }
 
             // Note: in a real world application, you'd probably prefer creating a specific view model.
-            return View("Authorize", Tuple.Create(request, application));
+            return View("Authorize", new AuthorisationView { Message = request, Application = application});
         }
 
-        [Authorize, HttpPost("~/connect/authorize/accept"), ValidateAntiForgeryToken]
+        [HttpPost("~/connect/authorize/accept"), ValidateAntiForgeryToken]
         public async Task<IActionResult> Accept(CancellationToken cancellationToken)
         {
             var response = HttpContext.GetOpenIdConnectResponse();
@@ -268,6 +274,7 @@ namespace Yavsc.Controllers
             var application = await GetApplicationAsync(request.ClientId, cancellationToken);
             if (application == null)
             {
+                _logger.LogError($"OidcError: {request.ClientId} {response.ClientId} ");
                 return View("OidcError", new OpenIdConnectMessage
                 {
                     Error = OpenIdConnectConstants.Errors.InvalidClient,
@@ -296,7 +303,7 @@ namespace Yavsc.Controllers
             // You can also limit the resources endpoints
             // the access token should be issued for:
             properties.SetResources(new[] {
-                "http://localhost:54540/"
+                _siteSettings.Audience
             });
 
             // This call will instruct AspNet.Security.OpenIdConnect.Server to serialize
@@ -312,7 +319,7 @@ namespace Yavsc.Controllers
             return new EmptyResult();
         }
 
-        [Authorize, HttpPost("~/connect/authorize/deny"), ValidateAntiForgeryToken]
+        [HttpPost("~/connect/authorize/deny"), ValidateAntiForgeryToken]
         public IActionResult Deny(CancellationToken cancellationToken)
         {
             var response = HttpContext.GetOpenIdConnectResponse();

Yavsc/src/Providers/OAuthProvider.cs

@@ -43,11 +43,11 @@ namespace Yavsc.Providers {
             }
 
             var database = context.HttpContext.RequestServices.GetRequiredService<ApplicationDbContext>();
-            _logger.LogInformation($"Searching fo app id {context.ClientId}");
+            _logger.LogInformation($"Searching fo app id {context.Request.ClientId}");
 
             // Retrieve the application details corresponding to the requested client_id.
             var application = await (from entity in database.Applications
-                                     where entity.ApplicationID == context.ClientId
+                                     where entity.ApplicationID == context.Request.ClientId
                                      select entity).SingleOrDefaultAsync(context.HttpContext.RequestAborted);
 
             if (application == null) {
@@ -66,7 +66,7 @@ namespace Yavsc.Providers {
 
                 return;
             }
-
+            _logger.LogInformation("do Validate Authorization!");
             context.Validated();
         }
 
@@ -120,19 +120,14 @@ namespace Yavsc.Providers {
 
                 return;
             }
-
+            _logger.LogInformation("do Validate Token request!");
             context.Validated();
         }
         
-        /// <summary>
-        /// List provided offline access tokens, to a given
-        /// user by its id
-        /// </summary>
-        /// <param name="userid"></param>
-        /// <returns></returns>
-        public List<string> GetOfflineTokens(string userid) {
-            
-            throw new NotImplementedException();
+        public override Task TokenEndpoint (TokenEndpointContext context)
+        {
+            _logger.LogWarning($"OIDC success : IsAccessToken: {context.AuthenticationTicket.IsAccessToken()}");
+            return Task.FromResult(0);
         }
     }
 }

Yavsc/src/Startup.cs

@@ -156,10 +156,12 @@ namespace Yavsc
                 RSAKeyUtils.GetKeyParameters(keyParamsFileInfo.Name) :
                 RSAKeyUtils.GenerateKeyAndSave(keyParamsFileInfo.Name);
             key = new RsaSecurityKey(keyParams);
+            
             services.Configure<SharedAuthenticationOptions>(options =>
             {
                 options.SignInScheme = "ServerCookie";
-            });
+            }); 
+            /*
             services.Configure<TokenAuthOptions>(
                 to =>
                 {
@@ -169,7 +171,7 @@ namespace Yavsc
                     new SigningCredentials(key, SecurityAlgorithms.RsaSha256Signature);
 
                 }
-            );
+            );*/
 
             services.Add(ServiceDescriptor.Singleton(typeof(IOptions<SiteSettings>), typeof(OptionsManager<SiteSettings>)));
             services.Add(ServiceDescriptor.Singleton(typeof(IOptions<SmtpSettings>), typeof(OptionsManager<SmtpSettings>)));
@@ -202,10 +204,6 @@ namespace Yavsc
                 {
                     option.User.AllowedUserNameCharacters += " ";
                     option.User.RequireUniqueEmail = true;
-                    option.Cookies.ApplicationCookie.LoginPath = "/authenticate";
-                    option.Cookies.ApplicationCookie.LogoutPath = "/signout"; 
-                    option.Cookies.ApplicationCookie.AccessDeniedPath = "/forbidden"; // TODO /forbidden
-                // FIXME option.Cookies.ApplicationCookie.ReturnUrlParameter = "target";
                 }
             ).AddEntityFrameworkStores<ApplicationDbContext>()
                  .AddTokenProvider<EmailTokenProvider<ApplicationUser>>(Constants.EMailFactor)
@@ -249,7 +247,7 @@ namespace Yavsc
                 });
                 // options.AddPolicy("EmployeeId", policy => policy.RequireClaim("EmployeeId", "123", "456"));
                 // options.AddPolicy("BuildingEntry", policy => policy.Requirements.Add(new OfficeEntryRequirement()));
-                options.AddPolicy("Authenticated", policy => policy.RequireAuthenticatedUser());
+                // options.AddPolicy("Authenticated", policy => policy.RequireAuthenticatedUser());
             });
 
             services.AddSingleton<IAuthorizationHandler, HasBadgeHandler>();
@@ -404,8 +402,7 @@ namespace Yavsc
                 EnableDirectoryBrowsing = false
             });
             app.UseStaticFiles().UseWebSockets();
-            app.UseIdentity();
-
+          
             app.UseOpenIdConnectServer(options =>
                {
                    options.Provider = new AuthorizationProvider(loggerFactory);
@@ -426,7 +423,7 @@ namespace Yavsc
                    options.TokenEndpointPath = new PathString("/connect/authorize/accept");
                    options.UseSlidingExpiration = true;
                    options.AllowInsecureHttp = true;
-                   options.AuthenticationScheme = "oidc"; // was = OpenIdConnectDefaults.AuthenticationScheme;
+                   options.AuthenticationScheme = "ServerCookie"; // was = OpenIdConnectDefaults.AuthenticationScheme || "oidc";
                    options.LogoutEndpointPath = new PathString("/connect/logout");
 
                    /* options.ValidationEndpointPath = new PathString("/connect/introspect"); */
@@ -434,6 +431,8 @@ namespace Yavsc
                
             app.UseWhen(context => context.Request.Path.StartsWithSegments(new PathString("/api")), branch =>
             {
+                branch.UseIdentity();
+
                 branch.UseJwtBearerAuthentication(options =>
                 {
                     options.AutomaticAuthenticate = true;
@@ -441,13 +440,15 @@ namespace Yavsc
                     options.RequireHttpsMetadata = false;
                     options.Audience = siteSettings.Value.Audience;
                     options.Authority = siteSettings.Value.Authority;
+                    
                 });
             });
 
+            
             // Create a new branch where the registered middleware will be executed only for API calls.
             app.UseWhen(context => !context.Request.Path.StartsWithSegments(new PathString("/api")), branch =>
             {
-                // Create a new branch where the registered middleware will be executed only for non API calls.
+                branch.UseIdentity();
                 branch.UseCookieAuthentication(options =>
                 {
                     options.AutomaticAuthenticate = true;
@@ -455,8 +456,9 @@ namespace Yavsc
                     options.AuthenticationScheme = "ServerCookie";
                     options.CookieName = CookieAuthenticationDefaults.CookiePrefix + "ServerCookie";
                     options.ExpireTimeSpan = TimeSpan.FromMinutes(5);
-                    options.LoginPath = new PathString("/authenticate");
+                    options.LoginPath = new PathString("/signin");
                     options.LogoutPath = new PathString("/signout");
+                    options.ReturnUrlParameter = "target";
                 });
 
                 branch.UseMiddleware<GoogleMiddleware>(googleOptions);
@@ -472,8 +474,6 @@ namespace Yavsc
 
             });
 
-            
-
             app.UseRequestLocalization(localizationOptions.Value, (RequestCulture)new RequestCulture((string)"fr"));
 
             /* Generic OAuth (here GitHub): options.Notifications = new OAuthAuthenticationNotifications
@@ -521,9 +521,6 @@ namespace Yavsc
                            }; */
 
 
-
-
-
             app.UseMvc(routes =>
             {
                 routes.MapRoute(

Yavsc/src/ViewModels/Auth/AuthorisationView.cs

@@ -0,0 +1,12 @@
+
+
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+
+namespace Yavsc
+{
+    public class AuthorisationView { 
+        public OpenIdConnectMessage Message { get; set; }
+        public Application Application { get; set; }
+        
+    }
+}

testOauthClient/.bowerrc

@@ -0,0 +1,3 @@
+{
+  "directory": "wwwroot/lib"
+}

testOauthClient/Controllers/AuthenticationController.cs

@@ -0,0 +1,19 @@
+
+using Microsoft.AspNet.Authentication.OpenIdConnect;
+using Microsoft.AspNet.Http.Authentication;
+using Microsoft.AspNet.Mvc;
+
+namespace Mvc.Client.Controllers {
+    
+    public class AuthenticationController : Controller {
+        
+        [HttpGet("~/signin")]
+        public ActionResult SignIn(string returnUrl) {
+            // Instruct the OIDC client middleware to redirect the user agent to the identity provider.
+            // Note: the authenticationType parameter must match the value configured in Startup.cs
+            var properties = new AuthenticationProperties { RedirectUri = "http://localhost:5002/" };
+            return new ChallengeResult(OpenIdConnectDefaults.AuthenticationScheme, properties);
+        }
+
+    }
+}

testOauthClient/Controllers/HomeController.cs

@@ -0,0 +1,35 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNet.Mvc;
+
+namespace testOauthClient.Controllers
+{
+    public class HomeController : Controller
+    {
+        public IActionResult Index()
+        {
+            return View();
+        }
+
+        public IActionResult About()
+        {
+            ViewData["Message"] = "Your application description page.";
+
+            return View();
+        }
+
+        public IActionResult Contact()
+        {
+            ViewData["Message"] = "Your contact page.";
+
+            return View();
+        }
+
+        public IActionResult Error()
+        {
+            return View();
+        }
+    }
+}

testOauthClient/Dockerfile

@@ -0,0 +1,11 @@
+FROM microsoft/aspnet:1.0.0-rc1-update1
+
+RUN printf "deb http://ftp.us.debian.org/debian jessie main\n" >> /etc/apt/sources.list
+RUN apt-get -qq update && apt-get install -qqy sqlite3 libsqlite3-dev && rm -rf /var/lib/apt/lists/*
+
+COPY . /app
+WORKDIR /app
+RUN ["dnu", "restore"]
+
+EXPOSE 5000/tcp
+ENTRYPOINT ["dnx", "-p", "project.json", "web"]

testOauthClient/README.md

@@ -0,0 +1,40 @@
+# Welcome to ASP.NET 5
+
+We've made some big updates in this release, so it’s **important** that you spend a few minutes to learn what’s new.
+
+You've created a new ASP.NET 5 project. [Learn what's new](http://go.microsoft.com/fwlink/?LinkId=518016)
+
+## This application consists of:
+
+*   Sample pages using ASP.NET MVC 6
+*   [Gulp](http://go.microsoft.com/fwlink/?LinkId=518007) and [Bower](http://go.microsoft.com/fwlink/?LinkId=518004) for managing client-side libraries
+*   Theming using [Bootstrap](http://go.microsoft.com/fwlink/?LinkID=398939)
+
+## How to
+
+*   [Add a Controller and View](http://go.microsoft.com/fwlink/?LinkID=398600)
+*   [Add an appsetting in config and access it in app.](http://go.microsoft.com/fwlink/?LinkID=699562)
+*   [Manage User Secrets using Secret Manager.](http://go.microsoft.com/fwlink/?LinkId=699315)
+*   [Use logging to log a message.](http://go.microsoft.com/fwlink/?LinkId=699316)
+*   [Add packages using NuGet.](http://go.microsoft.com/fwlink/?LinkId=699317)
+*   [Add client packages using Bower.](http://go.microsoft.com/fwlink/?LinkId=699318)
+*   [Target development, staging or production environment.](http://go.microsoft.com/fwlink/?LinkId=699319)
+
+## Overview
+
+*   [Conceptual overview of what is ASP.NET 5](http://go.microsoft.com/fwlink/?LinkId=518008)
+*   [Fundamentals of ASP.NET 5 such as Startup and middleware.](http://go.microsoft.com/fwlink/?LinkId=699320)
+*   [Working with Data](http://go.microsoft.com/fwlink/?LinkId=398602)
+*   [Security](http://go.microsoft.com/fwlink/?LinkId=398603)
+*   [Client side development](http://go.microsoft.com/fwlink/?LinkID=699321)
+*   [Develop on different platforms](http://go.microsoft.com/fwlink/?LinkID=699322)
+*   [Read more on the documentation site](http://go.microsoft.com/fwlink/?LinkID=699323)
+
+## Run & Deploy
+
+*   [Run your app](http://go.microsoft.com/fwlink/?LinkID=517851)
+*   [Run your app on .NET Core](http://go.microsoft.com/fwlink/?LinkID=517852)
+*   [Run commands in your project.json](http://go.microsoft.com/fwlink/?LinkID=517853)
+*   [Publish to Microsoft Azure Web Apps](http://go.microsoft.com/fwlink/?LinkID=398609)
+
+We would love to hear your [feedback](http://go.microsoft.com/fwlink/?LinkId=518015)

testOauthClient/Startup.cs

@@ -0,0 +1,101 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.AspNet.Builder;
+using Microsoft.AspNet.Hosting;
+using Microsoft.Extensions.Configuration;
+using Microsoft.Extensions.DependencyInjection;
+using Microsoft.Extensions.Logging;
+using Microsoft.AspNet.Authentication.OpenIdConnect;
+using Microsoft.AspNet.Authentication;
+using Microsoft.IdentityModel.Protocols.OpenIdConnect;
+using Microsoft.AspNet.Http;
+using Microsoft.AspNet.Authentication.Cookies;
+
+namespace testOauthClient
+{
+    public class Startup
+    {
+        public Startup(IHostingEnvironment env)
+        {
+            // Set up configuration sources.
+            var builder = new ConfigurationBuilder()
+                .AddJsonFile("appsettings.json")
+                .AddEnvironmentVariables();
+            Configuration = builder.Build();
+        }
+
+        public IConfigurationRoot Configuration { get; set; }
+
+        // This method gets called by the runtime. Use this method to add services to the container.
+        public void ConfigureServices(IServiceCollection services)
+        {
+          /*  services.Configure<SharedAuthenticationOptions>(options =>
+            {
+                options.SignInScheme = "ClientCookie";
+            }); */
+            services.AddAuthentication(options => {
+                options.SignInScheme = "ClientCookie";
+            });
+            // Add framework services.
+            services.AddMvc();
+        }
+
+        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
+        public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
+        {
+            loggerFactory.AddConsole(Configuration.GetSection("Logging"));
+            loggerFactory.AddDebug();
+
+            if (env.IsDevelopment())
+            {
+                app.UseDeveloperExceptionPage();
+            }
+            else
+            {
+                app.UseExceptionHandler("/Home/Error");
+            }
+            
+             app.UseCookieAuthentication(new CookieAuthenticationOptions {
+                AutomaticAuthenticate = true,
+                AutomaticChallenge = true,
+                AuthenticationScheme = "ClientCookie",
+                CookieName = CookieAuthenticationDefaults.CookiePrefix + "ClientCookie",
+                ExpireTimeSpan = TimeSpan.FromMinutes(5),
+                LoginPath = new PathString("/signin"),
+                LogoutPath = new PathString("/signout")
+            });
+
+            app.UseOpenIdConnectAuthentication(new OpenIdConnectOptions {
+                RequireHttpsMetadata = false,
+
+                // Note: these settings must match the application details
+                // inserted in the database at the server level.
+                ClientId = "016c5ae4-f4cd-40e3-b250-13701c871ecd",
+                ClientSecret = "blahblah",
+                PostLogoutRedirectUri = "http://dev.pschneider.fr/",
+
+                // Use the authorization code flow.
+                ResponseType = OpenIdConnectResponseTypes.Code,
+
+                // Note: setting the Authority allows the OIDC client middleware to automatically
+                // retrieve the identity provider's configuration and spare you from setting
+                // the different endpoints URIs or the token validation parameters explicitly.
+                Authority = "http://dev.pschneider.fr/"
+            });
+
+            app.UseStaticFiles();
+
+            app.UseMvc(routes =>
+            {
+                routes.MapRoute(
+                    name: "default",
+                    template: "{controller=Home}/{action=Index}/{id?}");
+            });
+        }
+
+        // Entry point for the application.
+        public static void Main(string[] args) => Microsoft.AspNet.Hosting.WebApplication.Run<Startup>(args);
+    }
+}

testOauthClient/Views/Home/About.cshtml

@@ -0,0 +1,7 @@
+@{
+    ViewData["Title"] = "About";
+}
+<h2>@ViewData["Title"].</h2>
+<h3>@ViewData["Message"]</h3>
+
+<p>Use this area to provide additional information.</p>

testOauthClient/Views/Home/Contact.cshtml

@@ -0,0 +1,17 @@
+@{
+    ViewData["Title"] = "Contact";
+}
+<h2>@ViewData["Title"].</h2>
+<h3>@ViewData["Message"]</h3>
+
+<address>
+    One Microsoft Way<br />
+    Redmond, WA 98052-6399<br />
+    <abbr title="Phone">P:</abbr>
+    425.555.0100
+</address>
+
+<address>
+    <strong>Support:</strong> <a href="mailto:Support@example.com">Support@example.com</a><br />
+    <strong>Marketing:</strong> <a href="mailto:Marketing@example.com">Marketing@example.com</a>
+</address>

testOauthClient/Views/Home/Index.cshtml

@@ -0,0 +1,30 @@
+@{
+    ViewData["Title"] = "Home Page";
+}
+
+<div class="jumbotron">
+    @if (User?.Identity?.IsAuthenticated ?? false) {
+        <h1>Welcome, @User.Identity.Name</h1>
+
+        <p>
+            @foreach (var claim in Context.User.Claims) {
+                <div>@claim.Type: <b>@claim.Value</b></div>
+            }
+        </p>
+
+        if (!string.IsNullOrEmpty(Model)) {
+            <h3>Message received from the resource controller: @Model</h3>
+        }
+
+        <form action="~/" method="post">
+            <button class="btn btn-lg btn-warning" type="submit">Query the resource controller</button>
+        </form>
+
+        <a class="btn btn-lg btn-danger" href="/signout">Sign out</a>
+    }
+
+    else {
+        <h1>Welcome, anonymous</h1>
+        <a class="btn btn-lg btn-success" href="/signin">Sign in</a>
+    }
+</div>

testOauthClient/Views/Shared/Error.cshtml

@@ -0,0 +1,6 @@
+@{
+    ViewData["Title"] = "Error";
+}
+
+<h1 class="text-danger">Error.</h1>
+<h2 class="text-danger">An error occurred while processing your request.</h2>

testOauthClient/Views/Shared/_Layout.cshtml

@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<html>
+    <head>
+        <meta charset="utf-8" />
+        <meta name="viewport" content="width=device-width, initial-scale=1.0" />
+        <title>@ViewData["Title"] - testOauthClient</title>
+
+        <environment names="Development">
+            <link rel="stylesheet" href="~/lib/bootstrap/dist/css/bootstrap.css" />
+            <link rel="stylesheet" href="~/css/site.css" />
+        </environment>
+        <environment names="Staging,Production">
+            <link rel="stylesheet" href="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/css/bootstrap.min.css"
+                  asp-fallback-href="~/lib/bootstrap/dist/css/bootstrap.min.css"
+                  asp-fallback-test-class="sr-only" asp-fallback-test-property="position" asp-fallback-test-value="absolute" />
+            <link rel="stylesheet" href="~/css/site.min.css" asp-append-version="true" />
+        </environment>
+    </head>
+    <body>
+        <div class="navbar navbar-inverse navbar-fixed-top">
+            <div class="container">
+                <div class="navbar-header">
+                    <button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
+                        <span class="sr-only">Toggle navigation</span>
+                        <span class="icon-bar"></span>
+                        <span class="icon-bar"></span>
+                        <span class="icon-bar"></span>
+                    </button>
+                    <a asp-controller="Home" asp-action="Index" class="navbar-brand">testOauthClient</a>
+                </div>
+                <div class="navbar-collapse collapse">
+                    <ul class="nav navbar-nav">
+                        <li><a asp-controller="Home" asp-action="Index">Home</a></li>
+                        <li><a asp-controller="Home" asp-action="About">About</a></li>
+                        <li><a asp-controller="Home" asp-action="Contact">Contact</a></li>
+                    </ul>
+                </div>
+            </div>
+        </div>
+        <div class="container body-content">
+            @RenderBody()
+            <hr />
+            <footer>
+                <p>&copy; 2016 - testOauthClient</p>
+            </footer>
+        </div>
+
+        <environment names="Development">
+            <script src="~/lib/jquery/dist/jquery.js"></script>
+            <script src="~/lib/bootstrap/dist/js/bootstrap.js"></script>
+            <script src="~/js/site.js" asp-append-version="true"></script>
+        </environment>
+        <environment names="Staging,Production">
+            <script src="https://ajax.aspnetcdn.com/ajax/jquery/jquery-2.1.4.min.js"
+                    asp-fallback-src="~/lib/jquery/dist/jquery.min.js"
+                    asp-fallback-test="window.jQuery">
+            </script>
+            <script src="https://ajax.aspnetcdn.com/ajax/bootstrap/3.3.5/bootstrap.min.js"
+                    asp-fallback-src="~/lib/bootstrap/dist/js/bootstrap.min.js"
+                    asp-fallback-test="window.jQuery && window.jQuery.fn && window.jQuery.fn.modal">
+            </script>
+            <script src="~/js/site.min.js" asp-append-version="true"></script>
+        </environment>
+
+        @RenderSection("scripts", required: false)
+    </body>
+</html>

testOauthClient/Views/_ViewImports.cshtml

@@ -0,0 +1,2 @@
+@using testOauthClient
+@addTagHelper "*, Microsoft.AspNet.Mvc.TagHelpers"

testOauthClient/Views/_ViewStart.cshtml

@@ -0,0 +1,3 @@
+@{
+    Layout = "_Layout";
+}

testOauthClient/appsettings.json

@@ -0,0 +1,10 @@
+{
+  "Logging": {
+    "IncludeScopes": false,
+    "LogLevel": {
+      "Default": "Verbose",
+      "System": "Information",
+      "Microsoft": "Information"
+    }
+  }
+}

testOauthClient/bower.json

@@ -0,0 +1,10 @@
+{
+  "name": "testOauthClient",
+  "private": true,
+  "dependencies": {
+    "bootstrap": "3.3.5",
+    "jquery": "2.1.4",
+    "jquery-validation": "1.14.0",
+    "jquery-validation-unobtrusive": "3.2.4"
+  }
+}

testOauthClient/gulpfile.js

@@ -0,0 +1,50 @@
+/// <binding Clean='clean' />
+"use strict";
+
+var gulp = require("gulp"),
+  rimraf = require("rimraf"),
+  concat = require("gulp-concat"),
+  cssmin = require("gulp-cssmin"),
+  shell = require("gulp-shell"),
+  uglify = require("gulp-uglify");
+
+var webroot = "./wwwroot/";
+
+var paths = {
+  js: webroot + "js/**/*.js",
+  minJs: webroot + "js/**/*.min.js",
+  css: webroot + "css/**/*.css",
+  minCss: webroot + "css/**/*.min.css",
+  concatJsDest: webroot + "js/site.min.js",
+  concatCssDest: webroot + "css/site.min.css"
+};
+
+gulp.task("clean:js", function (cb) {
+  rimraf(paths.concatJsDest, cb);
+});
+
+gulp.task("clean:css", function (cb) {
+  rimraf(paths.concatCssDest, cb);
+});
+
+gulp.task("clean", ["clean:js", "clean:css"]);
+
+gulp.task("min:js", function () {
+  return gulp.src([paths.js, "!" + paths.minJs], {
+    base: "."
+  })
+    .pipe(concat(paths.concatJsDest))
+    .pipe(uglify())
+    .pipe(gulp.dest("."));
+});
+
+gulp.task("min:css", function () {
+  return gulp.src([paths.css, "!" + paths.minCss])
+    .pipe(concat(paths.concatCssDest))
+    .pipe(cssmin())
+    .pipe(gulp.dest("."));
+});
+
+gulp.task("min", ["min:js", "min:css"]);
+gulp.task('watch', shell.task(['MONO_OPTIONS=--debug ASPNET_ENV=Development dnx-watch web --configuration=Debug --server.urls=http://*:5002']))
+

testOauthClient/package.json

@@ -0,0 +1,11 @@
+{
+  "name": "testOauthClient",
+  "version": "0.0.0",
+  "devDependencies": {
+    "gulp": "^3.9.0",
+    "gulp-concat": "2.5.2",
+    "gulp-cssmin": "0.1.7",
+    "gulp-uglify": "1.2.0",
+    "rimraf": "2.2.8"
+  }
+}

testOauthClient/project.json

@@ -0,0 +1,51 @@
+{
+  "version": "1.0.0-*",
+  "compilationOptions": {
+    "emitEntryPoint": true
+  },
+  "tooling": {
+    "defaultNamespace": "testOauthClient"
+  },
+  "dependencies": {
+    "Microsoft.AspNet.Diagnostics": "1.0.0-rc1-final",
+    "Microsoft.AspNet.IISPlatformHandler": "1.0.0-rc1-final",
+    "Microsoft.AspNet.Mvc": "6.0.0-rc1-final",
+    "Microsoft.AspNet.Mvc.TagHelpers": "6.0.0-rc1-final",
+    "Microsoft.AspNet.Server.Kestrel": "1.0.0-rc1-final",
+    "Microsoft.AspNet.StaticFiles": "1.0.0-rc1-final",
+    "Microsoft.AspNet.Tooling.Razor": "1.0.0-rc1-final",
+    "Microsoft.Extensions.Configuration.FileProviderExtensions": "1.0.0-rc1-final",
+    "Microsoft.Extensions.Configuration.Json": "1.0.0-rc1-final",
+    "Microsoft.Extensions.Logging": "1.0.0-rc1-final",
+    "Microsoft.Extensions.Logging.Console": "1.0.0-rc1-final",
+    "Microsoft.Extensions.Logging.Debug": "1.0.0-rc1-final",
+    "Microsoft.AspNet.Authentication.OpenIdConnect": "1.0.0-rc1-final",
+    "Microsoft.AspNet.Authentication.Cookies": "1.0.0-rc1-final"
+  },
+  "commands": {
+    "web": "Microsoft.AspNet.Server.Kestrel"
+  },
+  "frameworks": {
+    "dnx451": {}
+  },
+  "exclude": [
+    "wwwroot",
+    "node_modules",
+    "bower_components"
+  ],
+  "publishExclude": [
+    "node_modules",
+    "bower_components",
+    "**.xproj",
+    "**.user",
+    "**.vspscc"
+  ],
+  "scripts": {
+    "prepublish": [
+      "npm install",
+      "bower install",
+      "gulp clean",
+      "gulp min"
+    ]
+  }
+}

testOauthClient/wwwroot/css/site.css

@@ -0,0 +1,24 @@
+body {
+    padding-top: 50px;
+    padding-bottom: 20px;
+}
+
+/* Wrapping element */
+/* Set some basic padding to keep content from hitting the edges */
+.body-content {
+    padding-left: 15px;
+    padding-right: 15px;
+}
+
+/* Set widths on the form inputs since otherwise they're 100% wide */
+input,
+select,
+textarea {
+    max-width: 280px;
+}
+
+/* Carousel */
+.carousel-caption p {
+    font-size: 20px;
+    line-height: 1.4;
+}

testOauthClient/wwwroot/css/site.min.css

@@ -0,0 +1 @@
+body{padding-top:50px;padding-bottom:20px}.body-content{padding-left:15px;padding-right:15px}input,select,textarea{max-width:280px}.carousel-caption p{font-size:20px;line-height:1.4}

testOauthClient/wwwroot/js/site.js

@@ -0,0 +1 @@
+// Write your Javascript code.

testOauthClient/wwwroot/web.config

@@ -0,0 +1,9 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <system.webServer>
+    <handlers>
+      <add name="httpPlatformHandler" path="*" verb="*" modules="httpPlatformHandler" resourceType="Unspecified"/>
+    </handlers>
+    <httpPlatform processPath="%DNX_PATH%" arguments="%DNX_ARGS%" stdoutLogEnabled="false"/>
+  </system.webServer>
+</configuration>