app.UseOpenIdConnectServer(options => {
    options.Provider = new OpenIdConnectServerProvider {
        // Implement OnValidateAuthorizationRequest to support interactive flows (code/implicit/hybrid).
        OnValidateAuthorizationRequest = context => {
            // Note: you MUST NOT validate the request if client_id is invalid or if redirect_uri
            // doesn't correspond to a trusted URL associated with the client application.
            // You SHOULD also strongly consider validating the type of the client application
            // (public or confidential) to prevent code flow -> implicit flow downgrade attacks.
            if (string.Equals(context.ClientId, "client_id", StringComparison.Ordinal) &&
                string.Equals(context.RedirectUri, "redirect_uri", StringComparison.Ordinal)) {
                context.Validate();
            }

            // Note: if Validate() is not explicitly called,
            // the request is automatically rejected.
            return Task.FromResult(0);
        }

        // Implement OnValidateTokenRequest to support flows using the token endpoint.
        OnValidateTokenRequest = context => {
            // Note: you can skip the request validation when the client_id
            // parameter is missing to support unauthenticated token requests.
            // if (string.IsNullOrEmpty(context.ClientId)) {
            //     context.Skip();
            // }

            // Note: to mitigate brute force attacks, you SHOULD strongly consider applying
            // a key derivation function like PBKDF2 to slow down the secret validation process.
            // You SHOULD also consider using a time-constant comparer to prevent timing attacks.
            if (string.Equals(context.ClientId, "client_id", StringComparison.Ordinal) &&
                string.Equals(context.ClientSecret, "client_secret", StringComparison.Ordinal)) {
                context.Validate();
            }

            // Note: if Validate() is not explicitly called,
            // the request is automatically rejected.
            return Task.FromResult(0);
        }
    };
});