title: Verify Access Token - Asp.Net Identity
body: <p>I'm using ASP.Net Identity to implement external logins. After user logins in with Google I get google's external access token. I then make a second api call to <a href="https://github.com/tjoudeh/AngularJSAuthentication/blob/master/AngularJSAuthentication.API/Controllers/AccountController.cs#L167" rel="noreferrer">ObtainLocalAccessToken()</a> which trades the external access token for a new local one.</p>
  <p><code>ObtainLocalAccessToken()</code> calls <a href="https://github.com/tjoudeh/AngularJSAuthentication/blob/master/AngularJSAuthentication.API/Controllers/AccountController.cs#L175" rel="noreferrer">VerifyExternalAccessToken()</a> which verifies the external access token with the provider by manually making http calls and parsing the user_id.</p>
  <p><strong>How can I leverage ASP.NET identity to remove the entire method <code>VerifyExternalAccessToken()</code>?</strong></p>
  <p>I believe that's what <code>[HostAuthentication(DefaultAuthenticationTypes.ExternalBearer)]</code> is for isn't it? I want to decorate <code>ObtainLocalAccessToken()</code> endpoint with that attribute and send the external_access_token in the header (<code>{'Authorization' : 'Bearer xxx' }</code>), and it should populate <code>User.Identity</code> without needing to manually verify the external access token? I believe that’s the purpose, however I cannot get it working. I send a valid external access token from google and it gets rejected with a 401.</p>
  <p>I have this line in Startup.Auth btw:</p>
  <pre><code> app.UseOAuthBearerTokens(new OAuthAuthorizationServerOptions
          {
              TokenEndpointPath = new PathString(&quot;/Token&quot;),
              Provider = new ApplicationOAuthProvider(),
              AuthorizeEndpointPath = new PathString(&quot;/AccountApi/ExternalLogin&quot;),
              AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
              AllowInsecureHttp = true
          });
  </code></pre>
  <p>Alternatively, it is possible to use &quot;/Token&quot; endpoint to trade an external access token for a local one? Which approach is correct?</p>