using System;
using System.Collections.Generic;
using System.Linq;
using System.Net;
using System.Net.Http;
using System.Threading;
using System.Threading.Tasks;
using System.Web.Http;
using System.Web.Mvc;
using System.Web.Optimization;
using System.Web.Routing;
using Microsoft.WindowsAzure.ActiveDirectory.Authentication;

namespace AALSampleWebAPI
{
	// Note: For instructions on enabling IIS6 or IIS7 classic mode, 
	// visit http://go.microsoft.com/?LinkId=9394801

	public class WebApiApplication : System.Web.HttpApplication
	{
		static void Configure(HttpConfiguration config)
		{
			config.MessageHandlers.Add(new TokenValidationHandler());
		}
		
		protected void Application_Start()
		{
			AreaRegistration.RegisterAllAreas();

			FilterConfig.RegisterGlobalFilters(GlobalFilters.Filters);
			RouteConfig.RegisterRoutes(RouteTable.Routes);
			BundleConfig.RegisterBundles(BundleTable.Bundles);
			Configure(GlobalConfiguration.Configuration);
		}
	}
	internal class TokenValidationHandler : DelegatingHandler
	{
		// This function retrieves ACS token (in format of OAuth 2.0 Bearer Token type) from 
		// the Authorization header in the incoming HTTP request from the ShipperClient.
		private static bool TryRetrieveToken(HttpRequestMessage request, out string token)
		{
			token = null;
			IEnumerable<string> authzHeaders;
			if (!request.Headers.TryGetValues("Authorization", out authzHeaders) || authzHeaders.Count() > 1)
			{
				// Fail if no Authorization header or more than one Authorization headers 
				// are found in the HTTP request 
				return false;
			}

			// Remove the bearer token scheme prefix and return the rest as ACS token 
			var bearerToken = authzHeaders.ElementAt(0);
			token = bearerToken.StartsWith("Bearer ") ? bearerToken.Substring(7) : bearerToken;
			return true;
		}

		protected override Task<HttpResponseMessage> SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
		{
			HttpStatusCode statusCode;
			string token;

			if (!TryRetrieveToken(request, out token))
			{
				statusCode = HttpStatusCode.Unauthorized;
				return Task<HttpResponseMessage>.Factory.StartNew(() => new HttpResponseMessage(statusCode));
			}

			try
			{
				// Create an AAL AuthenticationContext object and link it to the tenant backing the ShipperService
				var authenticationContext = new AuthenticationContext("https://buchizoaal.accesscontrol.windows.net");

				// Configure the expected audience list for AuthenticationContext to validate the token. AuthenticationContext
				// will auto-retrieve the expected signing cert and issuer from the tenent's metadata endpoint to assist token
				// validation as well.
				authenticationContext.Options.Audiences.Add("http://localhost:5120/");

				// Invoke AuthenticationContext.AcceptToken to validate the token and receive a ClaimPrincipal on a successful validation
				Thread.CurrentPrincipal = authenticationContext.AcceptToken(token);

				return base.SendAsync(request, cancellationToken);
			}
			catch (AALAuthenticationException)
			{
				statusCode = HttpStatusCode.Unauthorized;
			}
			catch (WebException we)
			{
				statusCode = ((HttpWebResponse)we.Response).StatusCode;
			}
			catch (ArgumentException)
			{
				statusCode = HttpStatusCode.BadRequest;
			}
			catch (AALException)
			{
				statusCode = HttpStatusCode.Unauthorized;
			}
			catch (Exception)
			{
				statusCode = HttpStatusCode.InternalServerError;
			}
			return Task<HttpResponseMessage>.Factory.StartNew(() => new HttpResponseMessage(statusCode));
		}
	}
}

		private AssertionCredential assertionCredential;
		private AuthenticationContext authContext;
		private string ServiceHost = "http://localhost:5120/";

		private void AuthButton_Click(object sender, RoutedEventArgs e)
		{
			try
			{
				authContext = new AuthenticationContext("https://buchizoaal.accesscontrol.windows.net");
				authContext.Options.Audiences.Add(ServiceHost);

				//認証ダイアログ（ブラウザダイアログ）を表示する
				using (assertionCredential = authContext.AcquireUserCredentialUsingUI(ServiceHost))
				{
					if (assertionCredential == null) return;

					Output.Text += "\nAuthentication Success =============";
					Output.Text += "\nAssertion: " + assertionCredential.Assertion;
					Output.Text += "\nAssertionType: " + assertionCredential.AssertionType;

					//クレーム情報を表示するだけ（本題とあまり関係ない）
					var claimsPrincipal = authContext.AcceptToken(assertionCredential.Assertion);
					var Identity = claimsPrincipal.Identity as Microsoft.IdentityModel.Claims.ClaimsIdentity;
					Identity.Claims.ToList().ForEach(x => { Output.Text += "\n" + x.ClaimType + ": " + x.Value.ToString(); });

					var request = WebRequest.Create(new Uri(ServiceHost + "api/Values")) as HttpWebRequest;
					request.Method = "GET";
					request.ContentLength = 0;

					//認証ヘッダを生成する（OAuth2.0 Bearerトークンを生成して設定してる）
					request.Headers.Add("Authorization", assertionCredential.CreateAuthorizationHeader());

					using (var response = request.GetResponse() as HttpWebResponse)
					{
						using (var sr = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
						{
							var responseContent = sr.ReadToEnd();
							Output.Text += "\nContent: " + responseContent;
						}
					}
				}
			}
			catch(AALAuthenticationException aex)
			{
				Output.Text += "\n---------------\nAALAuthenticationException: " + aex.Message;
				Output.Text += "\nServiceErrorMessage: " + aex.ServiceErrorMessage;
				if (aex.InnerException != null)
				{
					Output.Text += "\nInnerException: " + aex.InnerException.Message;
				}
			}
			catch (Exception ex)
			{
				Output.Text += "\n---------------\nException: " + ex.Message;
			}
		}

using System;
using System.IO;
using System.Linq;
using System.Net;
using System.Text;
using Microsoft.WindowsAzure.ActiveDirectory.Authentication;

namespace AALConsoleClient
{
	class Program
	{

		static void Main(string[] args)
		{
			AssertionCredential assertionCredential;
			AuthenticationContext authContext;
			string ServiceHost = "http://localhost:5120/";
			try
			{
				authContext = new AuthenticationContext("https://buchizoaal.accesscontrol.windows.net");
				authContext.Options.Audiences.Add(ServiceHost);
				SymmetricKeyCredential credential = new SymmetricKeyCredential("＜ACSのサービスID＞", Convert.FromBase64String("＜ACSのサービスIDのキー＞"));
				using (assertionCredential = authContext.AcquireToken(ServiceHost, credential))
				{
					if (assertionCredential == null) return;

					Console.WriteLine("Authentication Success =============");
					Console.WriteLine("Assertion: " + assertionCredential.Assertion);
					var claimsPrincipal = authContext.AcceptToken(assertionCredential.Assertion);
					var Identity = claimsPrincipal.Identity as Microsoft.IdentityModel.Claims.ClaimsIdentity;
					Identity.Claims.ToList().ForEach(x => { Console.WriteLine(x.ClaimType + ": " + x.Value.ToString()); });

					var request = WebRequest.Create(new Uri(ServiceHost + "api/Values")) as HttpWebRequest;
					request.Method = "GET";
					request.ContentLength = 0;
					request.Headers.Add("Authorization", assertionCredential.CreateAuthorizationHeader());

					using (var response = request.GetResponse() as HttpWebResponse)
					{
						using (var sr = new StreamReader(response.GetResponseStream(), Encoding.UTF8))
						{
							var responseContent = sr.ReadToEnd();
							Console.WriteLine("Content: " + responseContent);
						}
					}
				}
			}
			catch(AALAuthenticationException aex)
			{
				Console.WriteLine(aex.Message);
				Console.WriteLine(aex.ServiceErrorMessage);
				if (aex.InnerException != null)
				{
					Console.WriteLine(aex.InnerException.Message);
				}
			}
			catch (Exception ex)
			{
				Console.WriteLine(ex.Message);
			}
			Console.ReadKey();
		}
	}
}