title: Token-based authentication for Web API in an application which uses SimpleMembershipProvider
body: <p>I have an <em>ASP.NET Web API MVC 5.0</em> application. I've configured an ASP.NET Web API as part of this application (contained in the same project). </p>
  
  <p>I'm currently attempting to add token-based authentication to my Web API. The guide I've been using however has been coding everything using <strong>Microsoft.AspNet.Identity</strong> with Owin. </p>
  
  <p>However, my MVC project is still using the System.Web.Security <strong>SimpleMembershipProvider</strong> - so initialising the membership tables and managing accounts is performed using the WebSecurity class.</p>
  
  <p>So, it looks like I have two options to move forward here: </p>
  
  <ol>
  <li>Update my MVC application to switch to use Microsoft.AspNet.Identity so that it will work with my Web API token authentication. </li>
  <li>Change my Web API authentication code to work with SimpleMembershipProvider</li>
  </ol>
  
  <p>Firstly, is it even practically possible to make my Web API authentication work with SimpleMembershipProvider? </p>
  
  <p>If I update my project to use Microsoft.Asp.Identity, it will involve a bit of work I'm sure. I'm game for doing that but just want to make sure it's not totally trivial to make my Web API token authentication work with SimpleMembershipProvider. Will there be any additional advantages to migrating to use Microsoft.Asp.Identity? </p>
  
  <p>Just to give an example of what I have for my Web API authentication: </p>
  
  <pre><code>public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
  {
      var userManager = context.OwinContext.GetUserManager&lt;ApplicationUserManager&gt;();
      var user = await userManager.FindAsync(context.UserName, context.Password);
      if (user == null)
      {
          context.SetError("invalid_grant", "The user name or password is incorrect");
          return;
      }
  
      var oAuthIdentity = await user.GenerateUserIdentityAsync(userManager, OAuthDefaults.AuthenticationType);
      var cookiesIdentity = await user.GenerateUserIdentityAsync(userManager, CookieAuthenticationDefaults.AuthenticationType);
      var properties = CreateProperties(user.UserName);
      var authenticationTicket = new AuthenticationTicket(oAuthIdentity, properties);
      context.Validated(authenticationTicket);
      context.Request.Context.Authentication.SignIn(cookiesIdentity);
  }
  </code></pre>
  
  <p>My existing MVC authentication code just uses the WebSecurity methods for managing accounts. </p>
  
  <p>Thank you. </p>