// HACK: metodo/action fica comentado, para esconder a sua existencia de acesso directo externo
        //public ActionResult LogOnFederated()
        //{
        //    //throw new NotImplementedException();
        //    return View();
        //}

        //
        // GET: /Account/LogOn

        public ActionResult LogOn()
        {
            // HACK: constante para seleccao do home realm na aplicacao web e nao no ACS

            // da' erro/nao servem de nada, pois e' necessario .cshtml ou .aspx a servir de intermediario
            //const string localLoginPageUrl = "~/Account/applocal2LoginPageCode.html";
            //const string localLoginPageUrl = "applocal2LoginPageCode.html";

            // view em .aspx a servir de intermediario para applocal2LoginPageCode.html
            //const string localLoginPageUrl = "~/Account/LogOnFederated";
            const string localLoginPageIntermediateViewName = "LogOnFederated";

            // HACK: em principio, sempre verdadeiro neste metodo (ou com !User.Identity.IsAuthenticated)
            //if (!Request.IsAuthenticated)
            //{
            //}

            // HACK: utilizar FederatedAuthentication, como alternativa ao pre-definido return View();
            // HACK: try..catch realizado,para caso do web.config ser alterado para nao ter WS-Federation
            try
            {
                /* 1 - tentar utilizar federacao:
                 * se conseguir (wsfam nao e' null, e nao ocorrem erros), faz redirect... */
                var wsfam = FederatedAuthentication.WSFederationAuthenticationModule;
                if (wsfam != null)
                {
                    var signInRequest = new SignInRequestMessage(new Uri(wsfam.Issuer), wsfam.Realm,
                                                                                            wsfam.Reply)
                    {
                        AuthenticationType = wsfam.AuthenticationType,
                        Context = wsfam.Realm,
                        Freshness = wsfam.Freshness,
                        HomeRealm = wsfam.HomeRealm
                    };

                    // 1.1 - seleccao do home realm no ACS
                    //return Redirect(signInRequest.WriteQueryString());

                    // 1.2 - seleccao do home realm na aplicacao web
                    
                    //return View("applocal2LoginPageCode"); // da' erro
                    
                    // HACK: action fica comentada, para esconder existencia de acesso directo externo,
                    // logo, redirect's tambem ficam comentados, para nao haver action com acesso externo
                    //return Redirect(localLoginPageUrl); // nao da' erro, se for a action LogOnFederated
                    //return RedirectToAction(localLoginPageIntermediateViewName, "Account");
                    
                    /* retorna-se a View, e assim, nao ha' acesso externo directo/explicto
                     * a esta view, pois nao existe action que corresponda apenas a esta view */
                    return View(localLoginPageIntermediateViewName);
                }
            }
            catch (Exception)
            {
                // 2 - ...em caso de erro, nao faz nada, pois...
                //throw;
            }
            // 3 - ...caso wsfam seja igual a null, ou em caso de erro, processa normalmente o LogOn
            return View();
        }

 private static void ValidateRequestIsSsl(bool requireSsl, SignInRequestMessage signInRequestMessage)
 {
     if (requireSsl && (signInRequestMessage.BaseUri.Scheme != Uri.UriSchemeHttps))
     {
         throw new InvalidRequestException("requests needs to be ssl");
     }
 }

        public async Task<SignInValidationResult> ValidateAsync(SignInRequestMessage message, ClaimsPrincipal subject)
        {
            var result = new SignInValidationResult();

            // todo: wfresh handling?
            if (!subject.Identity.IsAuthenticated)
            {
                return new SignInValidationResult
                {
                    IsSignInRequired = true,
                };
            };

            var rp = await _relyingParties.GetByRealmAsync(message.Realm);

            if (rp == null || rp.Enabled == false)
            {
                return new SignInValidationResult
                {
                    IsError = true,
                    Error = "invalid_relying_party"
                };
            }

            // todo: check wreply against list of allowed reply URLs
            result.ReplyUrl = rp.ReplyUrl;

            result.RelyingParty = rp;
            result.SignInRequestMessage = message;
            result.Subject = subject;

            return result;
        }

        public string GetResponseHtml(IDictionary<string, string> parameters, Uri signinUri)
        {
            var requestToken = new OAuthRequestToken {Token = parameters["oauth_token"]};

            // Exchange the Request Token for an Access Token
            var service = new TwitterService(Settings.TwitterConsumerKey, Settings.TwitterConsumerSecret);
            OAuthAccessToken accessToken = service.GetAccessToken(requestToken, parameters["oauth_verifier"]);

            // Claim values
            string name = accessToken.ScreenName;
            string nameIdentifier = string.Format("https://twitter.com/account/redirect_by_id?id={0}", accessToken.UserId);
            string token = accessToken.Token;
            string tokenSecret = accessToken.TokenSecret;

            string wtRealm = _configurationProvider.Get(Settings.TwitterWtRealm);
            string wReply = _configurationProvider.Get(Settings.TwitterWReply);

            var requestMessage = new SignInRequestMessage(signinUri, wtRealm, wReply);

            // Add claims
            var identity = new ClaimsIdentity(AuthenticationTypes.Federation);
            identity.AddClaim(new Claim(ClaimTypes.Name, name));
            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, nameIdentifier));
            identity.AddClaim(new Claim(TwitterClaims.TwitterToken, token));
            identity.AddClaim(new Claim(TwitterClaims.TwitterTokenSecret, tokenSecret));

            var principal = new ClaimsPrincipal(identity);

            // Serialize response message
            SignInResponseMessage responseMessage = FederatedPassiveSecurityTokenServiceOperations.ProcessSignInRequest(requestMessage, principal, this);
            responseMessage.Context = parameters["context"];

            return responseMessage.WriteFormPost();
        }

        public SignInResponseMessage Generate(SignInRequestMessage request, WindowsPrincipal windowsPrincipal)
        {
            Logger.Info("Creating WS-Federation signin response");

            // create subject
            var outgoingSubject = SubjectGenerator.Create(windowsPrincipal, _options);

            // create token for user
            var token = CreateSecurityToken(outgoingSubject);

            // return response
            var rstr = new RequestSecurityTokenResponse
            {
                AppliesTo = new EndpointReference(_options.IdpRealm),
                Context = request.Context,
                ReplyTo = _options.IdpReplyUrl,
                RequestedSecurityToken = new RequestedSecurityToken(token)
            };

            var serializer = new WSFederationSerializer(
                new WSTrust13RequestSerializer(),
                new WSTrust13ResponseSerializer());

            var mgr = SecurityTokenHandlerCollectionManager.CreateEmptySecurityTokenHandlerCollectionManager();
            mgr[SecurityTokenHandlerCollectionManager.Usage.Default] = CreateSupportedSecurityTokenHandler();

            var responseMessage = new SignInResponseMessage(
                new Uri(_options.IdpReplyUrl),
                rstr,
                serializer,
                new WSTrustSerializationContext(mgr));

            return responseMessage;
        }

 public ActionResult SignIn(SignInRequestMessage message)
 {
     var response = FederatedPassiveSecurityTokenServiceOperations.ProcessSignInRequest(
                         message,
                         HttpContext.User,
                         new CustomSecurityTokenService(new CustomSecurityTokenServiceConfiguration()));
     return new WSFederationResult(response);
 }

        public ActionResult Index()
        {
            ViewBag.Message = "Modify this template to jump-start your ASP.NET MVC application.";

            SignInRequestMessage signInRequestMessage = new SignInRequestMessage(new Uri("https://andras1/idsrv/issue/wsfed"), "http://localhost:2533/");
            ViewBag.StsSignInUrl = signInRequestMessage.WriteQueryString();

            return View();
        }

        public async Task<SignInValidationResult> ValidateAsync(SignInRequestMessage message, ClaimsPrincipal subject)
        {
            Logger.Info("Start WS-Federation signin request validation");
            var result = new SignInValidationResult();

            // parse whr
            if (!String.IsNullOrWhiteSpace(message.HomeRealm))
            {
                result.HomeRealm = message.HomeRealm;
            }

            // parse wfed
            if (!String.IsNullOrWhiteSpace(message.Federation))
            {
                result.Federation = message.Federation;
            }

            if (!subject.Identity.IsAuthenticated)
            {
                result.IsSignInRequired = true;
                return result;
            }

            // check realm
            var rp = await _relyingParties.GetByRealmAsync(message.Realm);

            if (rp == null || rp.Enabled == false)
            {
                LogError("Relying party not found: " + message.Realm, result);

                return new SignInValidationResult
                {
                    IsError = true,
                    Error = "invalid_relying_party"
                };
            }

            result.ReplyUrl = rp.ReplyUrl;
            result.RelyingParty = rp;
            result.SignInRequestMessage = message;
            result.Subject = subject;

            var customResult = await _customValidator.ValidateSignInRequestAsync(result);
            if (customResult.IsError)
            {
                LogError("Error in custom validation: " + customResult.Error, result);
                return new SignInValidationResult
                    {
                        IsError = true,
                        Error = customResult.Error,
                        ErrorMessage = customResult.ErrorMessage,
                    };
            }

            LogSuccess(result);
            return result;
        }

 public ActionResult SignIn(string returnUrl)
 {
     var fam = FederatedAuthentication.WSFederationAuthenticationModule;
     fam.SignIn(Guid.NewGuid().ToString());
     var signInRequestMessage = new SignInRequestMessage(new Uri(fam.Issuer), fam.Realm, returnUrl);
     var parameters = HmacHelper.CreateHmacRequestParametersFromConfig(Consts.PermissionHmacSettingsPrefix);
     parameters.ForEach(signInRequestMessage.Parameters.Add);
     return new RedirectResult(signInRequestMessage.WriteQueryString());
 }

        private static void AuthenticateUser(AuthorizationContext context, string realm)
        {
            // user is not authenticated and it's entering for the first time
            var fam = FederatedAuthentication.WSFederationAuthenticationModule;
            var signIn = new SignInRequestMessage(new Uri(fam.Issuer), realm ?? fam.Realm)
            {
                Context = "ru=" + context.HttpContext.Request.Path
            };

            context.Result = new RedirectResult(signIn.WriteQueryString());
        }

        protected override WSFederationMessage BuildSignInMessage(AuthorizationContext context, Uri replyUrl)
        {
            var fam = FederatedAuthentication.WSFederationAuthenticationModule;
            var signIn = new SignInRequestMessage(new Uri(fam.Issuer), fam.Realm)
            {
                Context = AuthenticateAndAuthorizeRoleAttribute.GetReturnUrl(context.RequestContext, RequestAppendAttribute.RawUrl, null).ToString(),
                HomeRealm = Tailspin.Federation.HomeRealm,
                Reply = replyUrl.ToString()
            };

            return signIn;
        }

    private static void AuthenticateUser(AuthorizationContext filterContext)
    {
        var organization = filterContext.RouteData.Values["organization"] as String ?? "mock.issuer.1";

        var returnUrl = GetReturnUrl(filterContext.RequestContext);
        var fam = FederatedAuthentication.WSFederationAuthenticationModule;
        var signIn = new SignInRequestMessage(new Uri(fam.Issuer), fam.Realm)
        {
            Context = returnUrl.ToString(),
            HomeRealm = GetHomeRealm(organization)
        };
        filterContext.Result = new RedirectResult(signIn.WriteQueryString());
    }

        private void RequestAuthentication(HttpContextBase httpContext, string identityProviderUrl, string realm, string replyUrl)
        {
            var signIn = new SignInRequestMessage(new Uri(identityProviderUrl), realm)
            {
                Context = replyUrl,
                Reply = replyUrl
            };

            var redirectUrl = signIn.WriteQueryString();

            httpContext.Response.Redirect(redirectUrl, false);
            httpContext.ApplicationInstance.CompleteRequest();
        }

        private ActionResult ProcessWSFederationSignIn(SignInRequestMessage message, ClaimsPrincipal principal)
        {
            // issue token and create ws-fed response
            var response = FederatedPassiveSecurityTokenServiceOperations.ProcessSignInRequest(
                message,
                principal as ClaimsPrincipal,
                TokenServiceConfiguration.Current.CreateSecurityTokenService());

            // set cookie for single-sign-out
            new SignInSessionsManager(HttpContext, _cookieName, ConfigurationRepository.Global.MaximumTokenLifetime)
                .AddEndpoint(response.BaseUri.AbsoluteUri);

            return new WSFederationResult(response, requireSsl: ConfigurationRepository.WSFederation.RequireSslForReplyTo);
        }

        private ActionResult ProcessSignIn(SignInRequestMessage signInMsg, ClaimsPrincipal user)
        {
            var config = new EmbeddedTokenServiceConfiguration();
            var sts = config.CreateSecurityTokenService();

            var appPath = Request.ApplicationPath;
            if (!appPath.EndsWith("/")) appPath += "/";

            signInMsg.Reply = new Uri(Request.Url, appPath).AbsoluteUri;
            var response = FederatedPassiveSecurityTokenServiceOperations.ProcessSignInRequest(signInMsg, user, sts);

            var body = response.WriteFormPost();
            return Html(body);
        }

        private ActionResult ProcessWSFederationSignIn(SignInRequestMessage message, IPrincipal principal)
        {
            // issue token and create ws-fed response
            var response = FederatedPassiveSecurityTokenServiceOperations.ProcessSignInRequest(
                message,
                principal,
                TokenServiceConfiguration.Current.CreateSecurityTokenService());

            // set cookie for single-sign-out
            new SignInSessionsManager(HttpContext, ConfigurationRepository.Configuration.MaximumTokenLifetime)
                .AddRealm(response.BaseUri.AbsoluteUri);

            return new WSFederationResult(response);
        }

        private static void AuthenticateUser(AuthorizationContext context)
        {
            var returnUrl = GetReturnUrl(context.RequestContext);

            // user is not authenticated and it's entering for the first time
            var fam = FederatedAuthentication.WSFederationAuthenticationModule;
            var signIn = new SignInRequestMessage(new Uri(fam.Issuer), fam.Realm)
            {
                Context = returnUrl.ToString(),
                Reply = returnUrl.ToString()
            };

            context.Result = new RedirectResult(signIn.WriteQueryString());
        }

        public string GetResponseHtml(IDictionary<string, string> parameters, Uri signinUri)
        {
            string code = parameters["code"];

            // Exchange the Request Token for an Access Token
            string appId = _settings.VkApplicationId;
            string appSecret = _settings.VkApplicationSecret;

            string scheme = parameters["SERVER_PORT_SECURE"] == "1" ? "https" : "http";

            var callbackUri = new UriBuilder(string.Format("{0}://{1}", scheme, parameters["HTTP_HOST"]))
            {
                Path = parameters["URL"],
                Query = string.Format("context={0}", parameters["context"])
            };

            var service = new VkClient(appId, appSecret);
            dynamic accessToken = service.GetAccessToken(code, callbackUri.ToString());

            dynamic token = accessToken.access_token;
            service.AuthenticateWith(token.ToString());

            // Claims
            dynamic result = service.Get("users.get", new
            {
                fields = "screen_name"
            });

            dynamic user = result.response[0];

            string acsNamespace = _settings.AcsNamespace;
            string wtRealm = string.Format(WtRealm, acsNamespace);
            string wReply = string.Format(WReply, acsNamespace);

            var requestMessage = new SignInRequestMessage(signinUri, wtRealm, wReply);

            // Add extracted claims
            var identity = new ClaimsIdentity(AuthenticationTypes.Federation);
            identity.AddClaim(new Claim(ClaimTypes.Name, string.Format("{0} {1}", user.first_name, user.last_name)));
            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.uid.ToString()));
            identity.AddClaim(new Claim(VkClaims.VkToken, token.ToString()));

            var principal = new ClaimsPrincipal(identity);

            SignInResponseMessage responseMessage = FederatedPassiveSecurityTokenServiceOperations.ProcessSignInRequest(requestMessage, principal, this);
            responseMessage.Context = parameters["context"];

            return responseMessage.WriteFormPost();
        }

        public static void LogOn(string issuer = null, string realm = null, string homeRealm = null)
        {
            WSFederationAuthenticationModule fam = FederatedAuthentication.WSFederationAuthenticationModule;
            
            var signInRequest = new SignInRequestMessage(new Uri(issuer ?? fam.Issuer), realm ?? fam.Realm)
            {
                AuthenticationType = fam.AuthenticationType,
                Context = GetReturnUrl(),
                Freshness = fam.Freshness,
                HomeRealm = homeRealm ?? fam.HomeRealm,
                Reply = fam.Reply
            };

            HttpContext.Current.Response.Redirect(signInRequest.WriteQueryString(), false);
            HttpContext.Current.ApplicationInstance.CompleteRequest();
        }

        protected override WSFederationMessage BuildSignInMessage(AuthorizationContext context, Uri replyUrl)
        {
            var tenant = (context.Controller as TenantController).Tenant;

            var fam = FederatedAuthentication.WSFederationAuthenticationModule;
            var signIn = new SignInRequestMessage(new Uri(fam.Issuer), fam.Realm)
            {
                Context = AuthenticateAndAuthorizeRoleAttribute.GetReturnUrl(context.RequestContext, RequestAppendAttribute.RawUrl, null).ToString(),
                HomeRealm = SubscriptionKind.Premium.Equals(tenant.SubscriptionKind)
                    ? tenant.IssuerIdentifier ?? Tailspin.Federation.HomeRealm + "/" + (context.Controller as TenantController).Tenant.Name
                    : Tailspin.Federation.HomeRealm + "/" + (context.Controller as TenantController).Tenant.Name,
                Reply = replyUrl.ToString()
            };

            return signIn;
        }