title: WebAPI get access token without username and password
body: <p>Im trying to sign in a user in web api without using their Username/Password combination. I have access to the User object for the user but need to "log them in" and return the access token to the client application for subsequent requests.</p>
  
  <p>I've tried variations on the following but with no luck, the <code>UserManager</code> object is disposed as soon as I call <code>GenerateUserIdentityAsync</code> the first time which causes it to fail for the <code>cookiesIdentity</code> and its warning me that my cast <code>OAuthGrantResourceOwnerContextCredentials</code> is a "Suspicious type conversion or check" but the code never reaches that line anyway; this is what Ive tried, which was taken and modified from the <code>GrantResourceOwnerCredentials</code> method of my <code>ApplicationOAuthProvider</code> class. Incidentally my Token end point works perfectly with the usual <code>username</code>, <code>password</code> and <code>grant_type</code> request.</p>
  
  <pre><code>var user = // Super secret way of getting the user....;
  Authentication.SignOut(DefaultAuthenticationTypes.ExternalCookie);
  // UserManager is not null at this point
  var oAuthIdentity = await user.GenerateUserIdentityAsync(UserManager,
                  OAuthDefaults.AuthenticationType);
  // UserManager is null at this point and so throws exception
  var cookiesIdentity = await user.GenerateUserIdentityAsync(UserManager,
                  CookieAuthenticationDefaults.AuthenticationType);
  
  var properties = ApplicationOAuthProvider.CreateProperties(user.UserName);
  var ticket = new AuthenticationTicket(oAuthIdentity, properties);
  
  
  ((OAuthGrantResourceOwnerCredentialsContext)HttpContext.Current.GetOwinContext().Request.Context)
              .Validated(ticket);
          HttpContext.Current.GetOwinContext().Request.Context.Authentication.SignIn(cookiesIdentity);
  </code></pre>
  
  <p>In essence all I want to do is return an access token for a user for which I do not have the username and password but a "secret" that I want to use instead of username password. Is there a way?</p>