Azure AD Auth Code

Startup.Auth.cs

private static readonly string ClientId = ConfigurationManager.AppSettings["ida:ClientId"];
private static readonly string AadInstance = ConfigurationManager.AppSettings["ida:AADInstance"];
private static readonly string TenantId = ConfigurationManager.AppSettings["ida:TenantId"];
private static readonly string PostLogoutRedirectUri = ConfigurationManager.AppSettings["ida:PostLogoutRedirectUri"];
private static readonly string Authority = AadInstance + TenantId;
private static readonly string TargetResourceId = ConfigurationManager.AppSettings["ida:TargetResourceId"];
public void ConfigureAuth(IAppBuilder app)
{
    app.SetDefaultSignInAsAuthenticationType(CookieAuthenticationDefaults.AuthenticationType);
    app.UseCookieAuthentication(new CookieAuthenticationOptions());
    app.UseOpenIdConnectAuthentication(
        new OpenIdConnectAuthenticationOptions
        {
            ClientId = ClientId,
            Authority = Authority,
            PostLogoutRedirectUri = PostLogoutRedirectUri,
            Notifications = new OpenIdConnectAuthenticationNotifications()
            {
                RedirectToIdentityProvider = ctx =>
                {
                    //if a token is needed (E.g., the user is anonymous, we'll be here)
                    return Task.FromResult(0);
                },
                MessageReceived = ctx =>
                {
                    //when an oauth message is received, this is the first event that fires. 
                    return Task.FromResult(0);
                },
                SecurityTokenReceived = ctx =>
                {
                    //this fires after the token is received but before it has been validated
                    return Task.FromResult(0);
                },
                AuthorizationCodeReceived = notification =>
                {
                    //we've asked for an authorization code because we need user authorization to act on the user's behalf to talk to the downstream service
                    //snag the cert
                    var rawCert = System.IO.File.ReadAllBytes(@"d:\temp\sa\ac\ac.pfx");
                    var ss = new SecureString();
                    "Watermelon".ToList().ForEach(ss.AppendChar);
                    var cert = new X509Certificate2(rawCert, ss);
                    //create a ClientAssertionCertificate to create the assertion
                    var clientAssertion = new ClientAssertionCertificate(ClientId, cert);
                    //get the authorization code out of the response - this code is used to request an access token to the downstream service
                    var code = notification.Code;
                    var authContext = new AuthenticationContext(Authority);
                    //request an access token to the downstream service (resource) using a combination of the auth code and app authentication (ID + Cert Assertion)
                    var result = authContext.AcquireTokenByAuthorizationCode(code, new Uri(HttpContext.Current.Request.Url.GetLeftPart(UriPartial.Path)), clientAssertion, TargetResourceId);
                    //add the claim to the user's claim set - this is a simple way to persist the token for future calls. you'd likely keep these somewhere else, like an encrypted database
                    notification.AuthenticationTicket.Identity.AddClaim(new Claim("http://schemas.jpd.ms/identity/token/access", result.AccessToken));

                    return Task.FromResult(result);
                },
                SecurityTokenValidated = ctx =>
                {
                    //at this point, the token has been received, validated and the cookie with the user identity is *just* about to be written.
                    //lookups to databases for roles or other user info can be added to the identity here.
                    return Task.FromResult(0);
                },
                AuthenticationFailed = ctx =>
                {
                    return Task.FromResult(0);
                },
            }
        });
}