public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context) { var allowedPaths = new List <string> { "/token", "/api/RefreshTokens" }; var allowedOrigin = context.OwinContext.Get <string>("as:clientAllowedOrigin"); var requestedPath = context.OwinContext.Get <string>("owin.RequestPath"); if (allowedOrigin == null) { allowedOrigin = "*"; } context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin }); //if (allowedPaths.Contains(requestedPath) ) //{ // if (allowedOrigin == null) // allowedOrigin = "*"; // context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin }); //} //var logedInUserName = context.Request.ReadFormAsync().Result["logedInUserName"]; var user = _authenticationBusinessComponent.AuthenticateUser(context.UserName, context.Password); if (user == null) { context.SetError("invalid_grant", "The user name or password is incorrect."); return; } var identity = new ClaimsIdentity(context.Options.AuthenticationType); identity.AddClaim(new Claim(ClaimTypes.Name, context.UserName)); identity.AddClaim(new Claim(ClaimTypes.Role, "user")); identity.AddClaim(new Claim("CompanyId", user.CompanyID.ToString())); identity.AddClaim(new Claim("sub", context.UserName)); var props = new AuthenticationProperties(new Dictionary <string, string> { { "as:client_id", (context.ClientId == null) ? string.Empty : context.ClientId }, { "userName", context.UserName } }); var ticket = new AuthenticationTicket(identity, props); context.Validated(ticket); }