public ValidationResult Validate(UserAccountService service, UserAccount account, string value)
        {
            if (String.IsNullOrWhiteSpace(value))
            {
                return new ValidationResult(Resources.ValidationMessages.PasswordRequired);
            }
            
            if (value.Length < this.MinimumLength)
            {
                return new ValidationResult(String.Format(Resources.ValidationMessages.PasswordLength, this.MinimumLength));
            }

            var upper = value.Any(x => Char.IsUpper(x));
            var lower = value.Any(x => Char.IsLower(x));
            var digit = value.Any(x => Char.IsDigit(x));
            var other = value.Any(x => !Char.IsUpper(x) && !Char.IsLower(x) && !Char.IsDigit(x));

            var vals = new bool[] { upper, lower, digit, other };
            var matches = vals.Where(x => x).Count();
            if (matches < this.MinimumNumberOfComplexityRules)
            {
                return new ValidationResult(String.Format(Resources.ValidationMessages.PasswordComplexityRules, this.MinimumNumberOfComplexityRules));
            }

            return null;
        }

        public virtual void SignIn(UserAccount account, string method)
        {
            if (account == null) throw new ArgumentNullException("account");
            if (String.IsNullOrWhiteSpace(method)) throw new ArgumentNullException("method");

            if (!account.IsAccountVerified)
            {
                throw new ValidationException("Account not yet verified");
            }

            if (!account.IsLoginAllowed)
            {
                throw new ValidationException("Login not allowed for this account");
            }

            // gather claims
            var claims =
                (from uc in account.Claims
                 select new Claim(uc.Type, uc.Value)).ToList();

            if (!String.IsNullOrWhiteSpace(account.Email))
            {
                claims.Insert(0, new Claim(ClaimTypes.Email, account.Email));
            }
            claims.Insert(0, new Claim(ClaimTypes.AuthenticationMethod, method));
            claims.Insert(0, new Claim(ClaimTypes.AuthenticationInstant, DateTime.UtcNow.ToString("s")));
            claims.Insert(0, new Claim(ClaimTypes.Name, account.Username));
            claims.Insert(0, new Claim(MembershipRebootConstants.ClaimTypes.Tenant, account.Tenant));
            claims.Insert(0, new Claim(ClaimTypes.NameIdentifier, account.ID.ToString("D")));

            // create principal/identity
            var id = new ClaimsIdentity(claims, method);
            var cp = new ClaimsPrincipal(id);

            // claims transform
            cp = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager.Authenticate(String.Empty, cp);

            // issue cookie
            var sam = FederatedAuthentication.SessionAuthenticationModule;
            if (sam == null)
            {
                Tracing.Verbose("[ClaimsBasedAuthenticationService.Signin] SessionAuthenticationModule is not configured");
                throw new Exception("SessionAuthenticationModule is not configured and it needs to be.");
            }

            var handler = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.SecurityTokenHandlers[typeof(SessionSecurityToken)] as SessionSecurityTokenHandler;
            if (handler == null)
            {
                Tracing.Verbose("[ClaimsBasedAuthenticationService.Signin] SessionSecurityTokenHandler is not configured");
                throw new Exception("SessionSecurityTokenHandler is not configured and it needs to be.");
            }

            var token = new SessionSecurityToken(cp, handler.TokenLifetime);
            token.IsPersistent = FederatedAuthentication.FederationConfiguration.WsFederationConfiguration.PersistentCookiesOnPassiveRedirects;
            token.IsReferenceMode = sam.IsReferenceMode;

            sam.WriteSessionTokenToCookie(token);

            Tracing.Verbose(String.Format("[ClaimsBasedAuthenticationService.Signin] cookie issued: {0}", claims.GetValue(ClaimTypes.NameIdentifier)));
        }

 public string GetTwoFactorAuthToken(UserAccount account)
 {
     if (account == null) throw new ArgumentNullException("account");
     var result = GetCookie(MembershipRebootConstants.AuthenticationService.CookieBasedTwoFactorAuthPolicyCookieName + account.Tenant);
     Tracing.Information("[CookieBasedTwoFactorAuthPolicy.ClearTwoFactorAuthToken] getting cookie for {0}, {1}, found:{2}", account.Tenant, account.Username, result);
     return result;
 }

        public static UserAccount Create(string username, string password, string email)
        {
            if (SecuritySettings.Instance.EmailIsUsername && username != email)
            {
                throw new ValidationException("Username must be the same as the Email");
            }

            UserAccount account = new UserAccount
            {
                Username = username,
                Email = email,
                Created = DateTime.UtcNow,
                IsAccountVerified = !SecuritySettings.Instance.RequireAccountVerification,
                IsLoginAllowed = SecuritySettings.Instance.AllowLoginAfterAccountCreation,
                Claims = new List<UserClaim>()
            };

            account.SetPassword(password);
            if (SecuritySettings.Instance.RequireAccountVerification)
            {
                account.VerificationKey = StripUglyBase64(Crypto.GenerateSalt());
                account.VerificationKeySent = DateTime.UtcNow;
            }

            return account;
        }

 public void Remove(UserAccount item)
 {
     foreach (var claim in item.Claims.ToArray())
     {
         item.Claims.Remove(claim);
     }
     db.Users.Remove(item);
 }

        public void SendAccountVerified(UserAccount user)
        {
            Tracing.Information(String.Format("[NotificationService.SendAccountVerified] {0}, {1}, {2}", user.Tenant, user.Username, user.Email));

            var msg = GetAccountVerifiedFormat();
            var body = DoTokenReplacement(msg, user);
            DeliverMessage(user, "Account Verified", body);
        }

        public virtual void SignIn(UserAccount account, string method)
        {
            if (account == null) throw new ArgumentNullException("account");
            if (String.IsNullOrWhiteSpace(method)) throw new ArgumentNullException("method");

            if (!account.IsAccountVerified)
            {
                throw new ValidationException(Resources.ValidationMessages.AccountNotVerified);
            }

            if (!account.IsLoginAllowed)
            {
                throw new ValidationException(Resources.ValidationMessages.LoginNotAllowed);
            }

            if (account.RequiresTwoFactorAuthToSignIn || 
                account.RequiresPasswordReset || 
                this.UserAccountService.IsPasswordExpired(account))
            {
                Tracing.Verbose("[AuthenticationService.SignIn] detected account requires two factor or password reset to sign in: {0}", account.ID);
                IssuePartialSignInToken(account, method);
                return;
            }

            // gather claims
            var claims = GetBasicClaims(account, method);
            
            // get the rest
            if (!String.IsNullOrWhiteSpace(account.Email))
            {
                claims.Add(new Claim(ClaimTypes.Email, account.Email));
            }
            if (!String.IsNullOrWhiteSpace(account.MobilePhoneNumber))
            {
                claims.Add(new Claim(ClaimTypes.MobilePhone, account.MobilePhoneNumber));
            }
            var x509 = from c in account.Certificates
                       select new Claim(ClaimTypes.X500DistinguishedName, c.Subject);
            claims.AddRange(x509);
            var otherClaims =
                (from uc in account.Claims
                 select new Claim(uc.Type, uc.Value)).ToList();
            claims.AddRange(otherClaims);

            // create principal/identity
            var id = new ClaimsIdentity(claims, method);
            var cp = new ClaimsPrincipal(id);

            // claims transform
            if (this.ClaimsAuthenticationManager != null)
            {
                cp = ClaimsAuthenticationManager.Authenticate(String.Empty, cp);
            }

            // issue cookie
            IssueToken(cp);
        }

 internal protected void ValidateUsername(UserAccount account, string value)
 {
     var result = this.usernameValidator.Value.Validate(this, account, value);
     if (result != null && result != ValidationResult.Success)
     {
         Tracing.Error("ValidateUsername failed: " + result.ErrorMessage);
         throw new ValidationException(result.ErrorMessage);
     }
 }

        public virtual void SignIn(UserAccount account, string method)
        {
            if (account == null) throw new ArgumentNullException("account");
            if (String.IsNullOrWhiteSpace(method)) throw new ArgumentNullException("method");

            if (!account.IsAccountVerified)
            {
                throw new ValidationException("Account not yet verified.");
            }

            if (!account.IsLoginAllowed)
            {
                throw new ValidationException("Login not allowed for this account.");
            }

            if (account.RequiresTwoFactorAuthToSignIn)
            {
                Tracing.Verbose("[AuthenticationService.SignIn] detected account requires two factor to sign in: {0}", account.Id);
                IssuePartialSignInTokenForTwoFactorAuth(account, method);
                return;
            }

            // gather claims
            var claims = GetBasicClaims(account, method);
            
            // get the rest
            if (!String.IsNullOrWhiteSpace(account.Email))
            {
                claims.Add(new Claim(ClaimTypes.Email, account.Email));
            }
            if (!String.IsNullOrWhiteSpace(account.MobilePhoneNumber))
            {
                claims.Add(new Claim(ClaimTypes.MobilePhone, account.MobilePhoneNumber));
            }
            var x509 = from c in account.Certificates
                       select new Claim(ClaimTypes.X500DistinguishedName, c.Subject);
            claims.AddRange(x509);
            var otherClaims =
                (from uc in account.Claims
                 select new Claim(uc.Type, uc.Value)).ToList();
            claims.AddRange(otherClaims);

            // create principal/identity
            var id = new ClaimsIdentity(claims, method);
            var cp = new ClaimsPrincipal(id);

            // claims transform
            cp = FederatedAuthentication.FederationConfiguration.IdentityConfiguration.ClaimsAuthenticationManager.Authenticate(String.Empty, cp);

            // issue cookie
            IssueToken(cp);
        }

        protected virtual string DoTokenReplacement(string msg, UserAccount user)
        {
            msg = msg.Replace("{username}", user.Username);
            msg = msg.Replace("{email}", user.Email);

            msg = msg.Replace("{applicationName}", appInfo.ApplicationName);
            msg = msg.Replace("{emailSignature}", appInfo.EmailSignature);
            msg = msg.Replace("{loginUrl}", appInfo.LoginUrl);

            msg = msg.Replace("{confirmAccountCreateUrl}", appInfo.VerifyAccountUrl + user.VerificationKey);
            msg = msg.Replace("{cancelNewAccountUrl}", appInfo.CancelNewAccountUrl + user.VerificationKey);

            msg = msg.Replace("{confirmPasswordResetUrl}", appInfo.ConfirmPasswordResetUrl + user.VerificationKey);
            msg = msg.Replace("{confirmChangeEmailUrl}", appInfo.ConfirmChangeEmailUrl + user.VerificationKey);

            
            return msg; 
        }

        internal static UserAccount Create(string tenant, string username, string password, string email)
        {
            UserAccount account = new UserAccount
            {
                Tenant = tenant,
                Username = username,
                Email = email,
                Created = DateTime.UtcNow,
                IsAccountVerified = !SecuritySettings.Instance.RequireAccountVerification,
                IsLoginAllowed = SecuritySettings.Instance.AllowLoginAfterAccountCreation,
                Claims = new List<UserClaim>()
            };

            account.SetPassword(password);
            if (SecuritySettings.Instance.RequireAccountVerification)
            {
                account.VerificationKey = StripUglyBase64(Crypto.GenerateSalt());
                account.VerificationKeySent = DateTime.UtcNow;
            }

            return account;
        }

 public virtual bool Authenticate(string username, string password, out UserAccount account)
 {
     return Authenticate(null, username, password, out account);
 }

        public virtual bool AuthenticateWithCertificate(Guid accountID, X509Certificate2 certificate, out UserAccount account)
        {
            Tracing.Information("[UserAccountService.AuthenticateWithCertificate] called for userID: {0}", accountID);
            
            certificate.Validate();

            account = this.GetByID(accountID);
            if (account == null) throw new ArgumentException("Invalid AccountID");

            var result = account.Authenticate(certificate);
            Update(account);

            Tracing.Verbose("[UserAccountService.AuthenticateWithCertificate] result: {0}", result);
            
            return result;
        }

        public virtual bool AuthenticateWithCode(Guid accountID, string code, out UserAccount account)
        {
            Tracing.Information("[UserAccountService.AuthenticateWithCode] called {0}", accountID);

            account = this.GetByID(accountID);
            if (account == null) throw new ArgumentException("Invalid AccountID");

            var result = account.VerifyTwoFactorAuthCode(code);
            Update(account);

            Tracing.Verbose("[UserAccountService.AuthenticateWithCode] result {0}", result);

            return result;
        }

        private void IssuePartialSignInTokenForTwoFactorAuth(UserAccount account, string method)
        {
            if (account == null) throw new ArgumentNullException("account");

            Tracing.Verbose("[AuthenticationService.IssuePartialSignInCookieForTwoFactorAuth] Account ID: {0}", account.ID);

            var claims = GetBasicClaims(account, method);

            var ci = new ClaimsIdentity(claims); // no auth type param so user will not be actually authenticated
            var cp = new ClaimsPrincipal(ci);

            IssueToken(cp, MembershipRebootConstants.AuthenticationService.TwoFactorAuthTokenLifetime, false);
        }

        public void SendChangeUsernameRequestNotice(UserAccount user)
        {
            Tracing.Information(String.Format("[NotificationService.SendChangeUsernameRequestNotice] {0}, {1}, {2}", user.Tenant, user.Username, user.Email));

            var msg = GetUsernameChangedNoticeFormat();
            var body = DoTokenReplacement(msg, user);
            DeliverMessage(user, "Username Changed", body);
        }

        public virtual bool IsPasswordExpired(UserAccount account)
        {
            if (account == null) throw new ArgumentNullException("account");

            return account.GetIsPasswordExpired(SecuritySettings.PasswordResetFrequency);
        }

        protected internal virtual void DeleteAccount(UserAccount account)
        {
            if (account == null) throw new ArgumentNullException("account");

            Tracing.Verbose("[UserAccountService.DeleteAccount] marking account as closed: {0}", account.ID);

            account.CloseAccount();
            Update(account);

            if (SecuritySettings.AllowAccountDeletion || !account.IsAccountVerified)
            {
                Tracing.Verbose("[UserAccountService.DeleteAccount] removing account record: {0}", account.ID);
                this.userRepository.Remove(account);
            }
        }

        public virtual void Update(UserAccount account)
        {
            if (account == null)
            {
                Tracing.Error("[UserAccountService.Update] called -- failed null account");
                throw new ArgumentNullException("account");
            }

            Tracing.Information("[UserAccountService.Update] called for account: {0}", account.ID);

            account.LastUpdated = account.UtcNow;
            this.userRepository.Update(account);
        }

        public void SendResetPassword(UserAccount user)
        {
            Tracing.Information(String.Format("[NotificationService.SendResetPassword] {0}, {1}, {2}", user.Tenant, user.Username, user.Email));

            var msg = GetResetPasswordFormat();
            var body = DoTokenReplacement(msg, user);
            DeliverMessage(user, "Password Reset Request", body);
        }