问JwtBearerAuthentication与ASP.Net 5和ASP.NET MVC 6

EN

public Startup(IHostingEnvironment env)
{
    const string _TokenIssuer = "http://localhost:5000/";
    const string _TokenAudience = "http://localhost:5000/";

public void ConfigureServices(IServiceCollection services)
    {
    ...
        RsaSecurityKey _signingKey = null;
        SigningCredentials signingCredentials = null;
        using (RSACryptoServiceProvider rsa = new RSACryptoServiceProvider(2048))
        {
            signingKey = new RsaSecurityKey(rsa.ExportParameters(true));
            signingCredentials = new SigningCredentials(_SigningKey, SecurityAlgorithms.RsaSha256Signature);
        }
        services.AddInstance<SigningCredentials>(signingCredentials);  // tobe used in JwtTokenHandler in the Token Controller

    var jwtOptions = new JwtBearerOptions();
        jwtOptions.AutomaticAuthenticate = true;
        jwtOptions.TokenValidationParameters.IssuerSigningKey = signingKey;
        jwtOptions.TokenValidationParameters.ValidAudience = _TokenAudience;
        jwtOptions.TokenValidationParameters.ValidIssuer = _TokenIssuer;
        services.AddInstance<JwtBearerOptions>(jwtOptions);   //tobe used in the Token Controller

        services.AddAuthorization(auth =>
        {
            auth.AddPolicy(JwtBearerDefaults.AuthenticationScheme, new AuthorizationPolicyBuilder()
                .AddAuthenticationSchemes(JwtBearerDefaults.AuthenticationScheme‌​)
                .RequireAuthenticatedUser().Build());
        });

        services.AddMvc();
        services.AddAuthentication();
    }

    // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
    public void Configure(IApplicationBuilder app, IHostingEnvironment env, ILoggerFactory loggerFactory)
    {
        ...
        //Add Bearer Authentication Middleware, make sure this is before UseIdentity line
        app.UseJwtBearerAuthentication(options =>
        {
            options.AutomaticAuthenticate = true;
            options.Audience = _TokenAudience;
            options.Authority = _TokenIssuer;
            options.RequireHttpsMetadata = false;
        });

        app.UseIdentity();
        app.UseMvc();
    }
}