MVC 5具有表单身份验证和与Bearer令牌web api后端交互

我有一个mvc 5应用程序，它使用表单身份验证，但真正的用户身份验证使用web api中的bearer令牌 . 我正在cookie中添加令牌详细信息，以便始终对网站进行身份验证 . MVC和Web api在同一个项目中 . Web api使用Owin托管 .

这是我的代码片段 .

startup.cs

public partial class Startup
{
    public void Configuration(IAppBuilder app)
    {

        //Configure authorization
        ConfigureOAuth(app);

        //register WebAPI
        app.UseWebApi(ConfigureWebApiRoutes());

    }
}

startup.auth.cs

// Enable the application to use a cookie to store information for the signed in user
          app.UseCookieAuthentication(new CookieAuthenticationOptions
          {
            AuthenticationType =       DefaultAuthenticationTypes.ApplicationCookie,
            LoginPath = new PathString("/Login/Login"),
            CookieHttpOnly = true,
            //AuthenticationMode = AuthenticationMode.Passive,
            CookieName = "YetAnotherTodo.WebApi.Auth",
            //#if DEBUG
            //                CookieSecure = CookieSecureOption.Never
            //#endif
        });


        // Use a cookie to temporarily store information about a user      logging in with a third party login provider
                         app.UseExternalSignInCookie(DefaultAuthenticationTypes.ExternalCookie);



        OAuthBearerOptions = new OAuthBearerAuthenticationOptions();

        // using OAuth authentication server as authentication middle ware  and Token Generation           
        app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
        {                
            TokenEndpointPath = new PathString("/token"),
            AccessTokenExpireTimeSpan = TimeSpan.FromDays(1),
            Provider = new SimpleAuthorizationServerProvider(),
            AuthorizeEndpointPath = new  PathString("/api/Account/ExternalLogin"),
            #if DEBUG
             AllowInsecureHttp = true
            #endif
        });
        app.UseOAuthBearerAuthentication(OAuthBearerOptions);

MVC登录控制器中的代码

[AllowAnonymous]
        [HttpPost]
        public async Task<ActionResult> Login(LoginViewModel model, string redirectUrl = null)
        {
         if (!ModelState.IsValid) return View(model);
         try
         {
         if (string.IsNullOrWhiteSpace(redirectUrl))
            {
                redirectUrl = "~/Home";
            }
            var result = await WebApiService.Instance.AuthenticateAsync<LogInResult>(model.UserName, model.Password);

            //Let's keep the user authenticated in the MVC webapp.
            //By using the AccessToken, we can use User.Identity.Name in the MVC controllers to make API calls.
            FormsAuthentication.SetAuthCookie(result.AccessToken, model.RememberMe);

            //Create an AuthenticationTicket to generate a cookie used to authenticate against Web API.
            //But before we can do that, we need a ClaimsIdentity that can be authenticated in Web API.
            var claims = new[]
            {
                new Claim(ClaimTypes.Name, model.UserName),
                //Name is the default name claim type, and UserName is the one known also in Web API.
                new Claim(ClaimTypes.NameIdentifier, model.UserName)
                //If you want to use User.Identity.GetUserId in Web API, you need a NameIdentifier claim.
            };

            //Generate a new ClaimsIdentity, using the DefaultAuthenticationTypes.ApplicationCookie authenticationType.
            //This also matches what we've set up in Web API.
            var claimsIdentity = new ClaimsIdentity(claims,DefaultAuthenticationTypes.ApplicationCookie);
            var authProperties = new AuthenticationProperties
            {
                ExpiresUtc = result.Expires,
                IsPersistent = model.RememberMe,
                IssuedUtc = result.Issued,
                RedirectUri = redirectUrl
            };
            var authTicket = new AuthenticationTicket(claimsIdentity, authProperties);

            //And now it's time to generate the cookie data. This is using the same code that is being used by the CookieAuthenticationMiddleware class in OWIN.
            byte[] userData = DataSerializers.Ticket.Serialize(authTicket);

            //Protect this user data and add the extra properties. These need to be the same as in Web API!
            //byte[] protectedData = MachineKey.Protect(userData, new[] { "Microsoft.Owin.Security.Cookies.CookieAuthenticationMiddleware", DefaultAuthenticationTypes.ApplicationCookie, "v1" });

            //base64-encode this data.
            string protectedText = TextEncodings.Base64Url.Encode(userData);

            //And now, we have the cookie.
            Response.SetCookie(new HttpCookie("YetAnotherTodo.WebApi.Auth")
            {
                HttpOnly = true,
                Expires = result.Expires.UtcDateTime,
                Value = protectedText
            });

我的提供程序中生成令牌的代码

AuthenticationTicket ticket;
        var cookiesIdentity = GenerateCookiesIdentity(context, user, out ticket);
        context.Validated(ticket);
        context.Request.Context.Authentication.SignIn(cookiesIdentity);

我能够登录并能够从令牌服务器获取票证，但是在后续请求中或登录后重定向到主页， I'm still getting 401 error .

这是这两个博客/教程的组合：Blog 1和Blog 2