/// <summary>
		/// Processes an incoming authorization-granted message from an SP and obtains an access token.
		/// </summary>
		/// <param name="openIdAuthenticationResponse">The OpenID authentication response that may be carrying an authorized request token.</param>
		/// <param name="cancellationToken">The cancellation token.</param>
		/// <returns>
		/// The access token, or null if OAuth authorization was denied by the user or service provider.
		/// </returns>
		/// <remarks>
		/// The access token, if granted, is automatically stored in the <see cref="ConsumerBase.TokenManager" />.
		/// The token manager instance must implement <see cref="IOpenIdOAuthTokenManager" />.
		/// </remarks>
		public async Task<AccessTokenResponse> ProcessUserAuthorizationAsync(IAuthenticationResponse openIdAuthenticationResponse, CancellationToken cancellationToken = default(CancellationToken)) {
			Requires.NotNull(openIdAuthenticationResponse, "openIdAuthenticationResponse");

			// The OAuth extension is only expected in positive assertion responses.
			if (openIdAuthenticationResponse.Status != AuthenticationStatus.Authenticated) {
				return null;
			}

			// Retrieve the OAuth extension
			var positiveAuthorization = openIdAuthenticationResponse.GetExtension<AuthorizationApprovedResponse>();
			if (positiveAuthorization == null) {
				return null;
			}

			using (var client = this.CreateHttpClient(new AccessToken(positiveAuthorization.RequestToken, string.Empty))) {
				var request = new HttpRequestMessage(this.ServiceProvider.TokenRequestEndpointMethod, this.ServiceProvider.TokenRequestEndpoint);
				using (var response = await client.SendAsync(request, cancellationToken)) {
					response.EnsureSuccessStatusCode();

					// Parse the response and ensure that it meets the requirements of the OAuth 1.0 spec.
					string content = await response.Content.ReadAsStringAsync();
					var responseData = HttpUtility.ParseQueryString(content);
					string accessToken = responseData[Protocol.TokenParameter];
					string tokenSecret = responseData[Protocol.TokenSecretParameter];
					ErrorUtilities.VerifyProtocol(!string.IsNullOrEmpty(accessToken), MessagingStrings.RequiredParametersMissing, typeof(AuthorizedTokenResponse).Name, Protocol.TokenParameter);
					ErrorUtilities.VerifyProtocol(tokenSecret != null, MessagingStrings.RequiredParametersMissing, typeof(AuthorizedTokenResponse).Name, Protocol.TokenSecretParameter);

					responseData.Remove(Protocol.TokenParameter);
					responseData.Remove(Protocol.TokenSecretParameter);
					return new AccessTokenResponse(accessToken, tokenSecret, responseData);
				}
			}
		}

 private void SetUserInformationGeneric(IAuthenticationResponse response)
 {
     var userdata = response.GetExtension<ClaimsResponse>();
     var email = userdata.Email;
     FullName = userdata.FullName;
     Email = email;
 }

		/// <summary>
		/// Processes an incoming authorization-granted message from an SP and obtains an access token.
		/// </summary>
		/// <param name="openIdAuthenticationResponse">The OpenID authentication response that may be carrying an authorized request token.</param>
		/// <returns>
		/// The access token, or null if OAuth authorization was denied by the user or service provider.
		/// </returns>
		/// <remarks>
		/// The access token, if granted, is automatically stored in the <see cref="ConsumerBase.TokenManager"/>.
		/// The token manager instance must implement <see cref="IOpenIdOAuthTokenManager"/>.
		/// </remarks>
		public AuthorizedTokenResponse ProcessUserAuthorization(IAuthenticationResponse openIdAuthenticationResponse) {
			Requires.NotNull(openIdAuthenticationResponse, "openIdAuthenticationResponse");
			Requires.ValidState(this.TokenManager is IOpenIdOAuthTokenManager);
			var openidTokenManager = this.TokenManager as IOpenIdOAuthTokenManager;
			ErrorUtilities.VerifyOperation(openidTokenManager != null, OAuthStrings.OpenIdOAuthExtensionRequiresSpecialTokenManagerInterface, typeof(IOpenIdOAuthTokenManager).FullName);

			// The OAuth extension is only expected in positive assertion responses.
			if (openIdAuthenticationResponse.Status != AuthenticationStatus.Authenticated) {
				return null;
			}

			// Retrieve the OAuth extension
			var positiveAuthorization = openIdAuthenticationResponse.GetExtension<AuthorizationApprovedResponse>();
			if (positiveAuthorization == null) {
				return null;
			}

			// Prepare a message to exchange the request token for an access token.
			// We are careful to use a v1.0 message version so that the oauth_verifier is not required.
			var requestAccess = new AuthorizedTokenRequest(this.ServiceProvider.AccessTokenEndpoint, Protocol.V10.Version) {
				RequestToken = positiveAuthorization.RequestToken,
				ConsumerKey = this.ConsumerKey,
			};

			// Retrieve the access token and store it in the token manager.
			openidTokenManager.StoreOpenIdAuthorizedRequestToken(this.ConsumerKey, positiveAuthorization);
			var grantAccess = this.Channel.Request<AuthorizedTokenResponse>(requestAccess);
			this.TokenManager.ExpireRequestTokenAndStoreNewAccessToken(this.ConsumerKey, positiveAuthorization.RequestToken, grantAccess.AccessToken, grantAccess.TokenSecret);

			// Provide the caller with the access token so it may be associated with the user
			// that is logging in.
			return grantAccess;
		}

        private static void SetCommenterValuesFromOpenIdResponse(IAuthenticationResponse response, Commenter commenter)
        {
            var claimsResponse = response.GetExtension<ClaimsResponse>();
            if (claimsResponse != null)
            {
                if (string.IsNullOrWhiteSpace(commenter.Name) && string.IsNullOrWhiteSpace(claimsResponse.Nickname) == false)
                    commenter.Name = claimsResponse.Nickname;
                else if (string.IsNullOrWhiteSpace(commenter.Name) && string.IsNullOrWhiteSpace(claimsResponse.FullName) == false)
                    commenter.Name = claimsResponse.FullName;
                if (string.IsNullOrWhiteSpace(commenter.Email) && string.IsNullOrWhiteSpace(claimsResponse.Email) == false)
                    commenter.Email = claimsResponse.Email;
            }
            var fetchResponse = response.GetExtension<FetchResponse>();
            if (fetchResponse != null) // let us try from the attributes
            {
                if (string.IsNullOrWhiteSpace(commenter.Email))
                    commenter.Email = fetchResponse.GetAttributeValue(WellKnownAttributes.Contact.Email);
                if (string.IsNullOrWhiteSpace(commenter.Name))
                {
                    commenter.Name = fetchResponse.GetAttributeValue(WellKnownAttributes.Name.FullName) ??
                                     fetchResponse.GetAttributeValue(WellKnownAttributes.Name.First) + " " +
                                     fetchResponse.GetAttributeValue(WellKnownAttributes.Name.Last);
                }

                if (string.IsNullOrWhiteSpace(commenter.Url))
                {
                    commenter.Url = fetchResponse.GetAttributeValue(WellKnownAttributes.Contact.Web.Blog) ??
                                fetchResponse.GetAttributeValue(WellKnownAttributes.Contact.Web.Homepage);
                }
            }
        }

        public virtual UserClaim GetUserClaim(IAuthenticationResponse response)
        {
            if (response == null) return null;

            switch (response.Status) {
                case AuthenticationStatus.Authenticated:
                    var claimsResponse = response.GetExtension<ClaimsResponse>();

                    if (claimsResponse != null) {
                        return new UserClaim {
                            Username = claimsResponse.Nickname,
                            Email = claimsResponse.Email,
                            Name = claimsResponse.FullName,
                            Identifier = response.FriendlyIdentifierForDisplay
                        };
                    }

                    return null;
                case AuthenticationStatus.Canceled:
                case AuthenticationStatus.Failed:
                    return null;
            }

            return null;
        }

 private void SetUserInformationFromGoogle(IAuthenticationResponse response)
 {
     var userdata = response.GetExtension<FetchResponse>();
     var firstname = userdata.GetAttributeValue(WellKnownAttributes.Name.First);
     var lastname = userdata.GetAttributeValue(WellKnownAttributes.Name.Last);
     FullName = firstname + " " + lastname;
     Email = userdata.GetAttributeValue(WellKnownAttributes.Contact.Email);
 }

 protected override string HandleUnknownUser(IAuthenticationResponse response)
 {
     string username = response.ClaimedIdentifier.ToString();
     string email = response.ClaimedIdentifier.ToString();
     string comment = null;
     var sreg = response.GetExtension<DotNetOpenAuth.OpenId.Extensions.SimpleRegistration.ClaimsResponse>();
     if (sreg != null)
     {
         if (sreg.Nickname != null)
         {
             comment = sreg.Nickname;
         }
         if (sreg.Email != null)
         {
             email = sreg.Email;
         }
     }
     var ax = response.GetExtension<DotNetOpenAuth.OpenId.Extensions.AttributeExchange.FetchResponse>();
     if (ax != null)
     {
         if (ax.Attributes.Contains(WellKnownAttributes.Contact.Email))
         {
             IList<string> emailAddresses = ax.Attributes[WellKnownAttributes.Contact.Email].Values;
             email = emailAddresses.Count > 0 ? emailAddresses[0] : email;
         }
         if (ax.Attributes.Contains(WellKnownAttributes.Name.Alias))
         {
             IList<string> aliasNames = ax.Attributes[WellKnownAttributes.Name.Alias].Values;
             comment = aliasNames.Count > 0 ? aliasNames[0] : comment;
         }
     }
     try
     {
         var user = Membership.CreateUser(username, Guid.NewGuid().ToString(), email);
         NHOpenIDMembershipProvider idprov = Provider as NHOpenIDMembershipProvider;
         MembershipCreateStatus status;
         idprov.AddIdToUser(user, response.ClaimedIdentifier, out status);
         if (status == MembershipCreateStatus.Success)
         {
             if (String.IsNullOrEmpty(comment)) {
               user.Comment = email;
             } else {
               user.Comment = comment;
             }
             Provider.UpdateUser(user);
             return user.UserName;
         }
         else
         {
             Provider.DeleteUser(user.UserName, true);
         }
     }
     catch (MembershipCreateUserException)
     {
         return null;
     }
     return null;
 }

 public override bool TryGetOpenIdResponse(out IAuthenticationResponse openIdResponse)
 {
     openIdResponse = openIdRelyingParty.GetResponse();
     if (openIdResponse.IsNull())
     {
         return false;
     }
     return true;
 }

		/// <summary>
		/// Initializes a new instance of the <see cref="AuthenticationResponseShim"/> class.
		/// </summary>
		/// <param name="response">The response.</param>
		internal AuthenticationResponseShim(IAuthenticationResponse response) {
			Contract.Requires<ArgumentNullException>(response != null);

			this.response = response;
			var claimsResponse = this.response.GetExtension<ClaimsResponse>();
			if (claimsResponse != null) {
				this.ClaimsResponse = new ClaimsResponseShim(claimsResponse);
			}
		}

		/// <summary>
		/// Initializes a new instance of the <see cref="AuthenticationResponseShim"/> class.
		/// </summary>
		/// <param name="response">The response.</param>
		internal AuthenticationResponseShim(IAuthenticationResponse response) {
			Requires.NotNull(response, "response");

			this.response = response;
			var claimsResponse = this.response.GetExtension<ClaimsResponse>();
			if (claimsResponse != null) {
				this.ClaimsResponse = new ClaimsResponseShim(claimsResponse);
			}
		}

        /// <summary>
        /// Initializes a new instance of the <see cref="AuthenticationResponseShim"/> class.
        /// </summary>
        /// <param name="response">The response.</param>
        internal AuthenticationResponseShim(IAuthenticationResponse response)
        {
            Contract.Requires(response != null);
            ErrorUtilities.VerifyArgumentNotNull(response, "response");

            this.response = response;
            var claimsResponse = this.response.GetExtension<ClaimsResponse>();
            if (claimsResponse != null) {
                this.ClaimsResponse = new ClaimsResponseShim(claimsResponse);
            }
        }

		/// <summary>
		/// Gets the extra data obtained from the response message when authentication is successful.
		/// </summary>
		/// <param name="response">
		/// The response message. 
		/// </param>
		/// <returns>
		/// </returns>
		protected override Dictionary<string, string> GetExtraData(IAuthenticationResponse response) {
			FetchResponse fetchResponse = response.GetExtension<FetchResponse>();
			if (fetchResponse != null) {
				var extraData = new Dictionary<string, string>();
				extraData.AddItemIfNotEmpty("email", fetchResponse.GetAttributeValue(WellKnownAttributes.Contact.Email));
				extraData.AddItemIfNotEmpty("fullName", fetchResponse.GetAttributeValue(WellKnownAttributes.Name.FullName));

				return extraData;
			}

			return null;
		}

        protected override Dictionary<string, string> GetExtraData(IAuthenticationResponse response)
        {
            var fetchResponse = response.GetExtension<FetchResponse>();
            if (fetchResponse != null)
            {
                var extraData = new Dictionary<string, string>();
                extraData.AddItemIfNotEmpty(ClaimTypes.IsPersistent, fetchResponse.GetAttributeValue(ClaimTypes.IsPersistent));

                return extraData;
            }
            return null;
        }

 public static string GetFriendlyOpenId(IAuthenticationResponse response, string email)
 {
     if (response.ClaimedIdentifier.ToString().Contains(WellKnownProviders.Google))
     {
         return "Google(" + email + ")";
     }
     if (response.ClaimedIdentifier.ToString().Contains(WellKnownProviders.Yahoo))
     {
         return "Yahoo(" + email + ")";
     }
     return response.FriendlyIdentifierForDisplay;
 }

 protected override Dictionary<string, string> GetExtraData(IAuthenticationResponse response)
 {
     FetchResponse extension = response.GetExtension<FetchResponse>();
     if (extension != null)
     {
         Dictionary<string, string> dictionary = new Dictionary<string, string>();
         dictionary.Add("email", extension.GetAttributeValue("http://axschema.org/contact/email"));
         dictionary.Add("name", extension.GetAttributeValue("http://axschema.org/namePerson/first") + " " + extension.GetAttributeValue("http://axschema.org/namePerson/last"));
         return dictionary;
     }
     return null;
 }

   /// <summary>
   /// This authenticates a user based on a response from an openid provider.
   /// </summary>
   /// <param name="response"></param>
   private void AuthenticateUser(IAuthenticationResponse response)
   {
      if (response.Status != AuthenticationStatus.Authenticated)
         throw new ArgumentException("The response status must be 'Authenticated'. (" + response.Status.ToString() + ")", "response");

      Identifier identifier = response.ClaimedIdentifier;

      if (identifier == null)
      {
         lblError.Text = "Oops! We lost the ID you tried to log in with. Can you try again?";
      }
      else
      {
         using (SqlConnection cn = new SqlConnection(Database.TadMapConnection))
         {
            cn.Open();
            using (SqlCommand cm = cn.CreateCommand())
            {
               cm.CommandType = CommandType.StoredProcedure;
               cm.CommandText = "GetUserId";
               cm.Parameters.AddWithValue("@OpenIdUrl", identifier.ToString());

               using (SqlDataReader dr = cm.ExecuteReader())
               {
                  if (dr.Read())
                  {
                     // a record was found so the user already exists
                     // in the future we can use this to populate the identity
                     // with display name and image...
                  }
                  else
                  {
                     // no user was found so we create it now.
                     CreateNewUser(identifier.ToString());
                  }
               }
            }
         }

         // somehow we need to put the response.FriendlyIdentifierForDisplay
         // into the identity/principal

         if (Request.QueryString["ReturnUrl"] != null)
         {
            FormsAuthentication.RedirectFromLoginPage(identifier.ToString(), false);
         }
         else
         {
            FormsAuthentication.SetAuthCookie(identifier.ToString(), false);
            Response.Redirect("MyImages.aspx", false);
         }
      }
   }

        internal AuthenticationResult ProcessOpenIdResponse(IAuthenticationResponse response)
        {
            switch (response.Status)
            {
                default:
                {
                    return AbortedAuthentication(Common.Resources.Authentication.InvalidOpenAuthenticationStatus);
                }
                case AuthenticationStatus.Canceled:
                {
                    return AbortedAuthentication(Common.Resources.Authentication.CanceledAtProvider, ConnectionStatus.Canceled);
                }
                case AuthenticationStatus.Failed:
                {
                    return AuthenticationException(response.Exception);
                }
                case AuthenticationStatus.Authenticated:
                {
                    string openId = response.ClaimedIdentifier;
                    User user = userService.GetByOpenId(openId);
                    bool isNewUser = false;
                    bool isNewConnection = false;
                    if (user == null)
                    {
                        isNewConnection = true;

                        string email = null;
                        string displayName = null;
                        var fetch = response.GetExtension<FetchResponse>();
                        if (fetch != null)
                        {
                            email = fetch.GetAttributeValue(WellKnownAttributes.Contact.Email);
                            displayName = fetch.GetAttributeValue(WellKnownAttributes.Name.FullName);
                        }
                        if (!email.NullOrEmpty()) // maybe they already have an account.
                        {
                            user = userService.GetByEmail(email);
                        }
                        if (user == null) // create a brand new account.
                        {
                            user = userService.CreateWithOpenId(openId, email, displayName);
                            isNewUser = true;
                        }
                        else // just connect the existing account to their OpenId account.
                        {
                            userService.AddOpenIdConnection(user, openId);
                        }
                    }
                    return SuccessfulAuthentication(user, isNewUser, isNewConnection);
                }
            }
        }

        private Interfaces.IAuthenticationResponse GetUserIdentity(IAuthenticationResponse response)
        {
            var identifier = response.ClaimedIdentifier;
            var fetch = response.GetExtension<FetchResponse>();
            Interfaces.IUserIdentity userIdentity = (fetch == null)
                ? null
                : Factory.GetUserIdentity(response.ClaimedIdentifier.ToString(),
                    fetch.GetAttributeValue(WellKnownAttributes.Name.First),
                    fetch.GetAttributeValue(WellKnownAttributes.Name.Last),
                    fetch.GetAttributeValue(WellKnownAttributes.Contact.Email));

            return Factory.AuthenticationResponse(userIdentity);
        }

 public UserInformation(IAuthenticationResponse response)
 {
     Response = response;
     ClaimedIdentifier = response.ClaimedIdentifier.ToString();
     if (response.Provider.Uri.Host == OpenIdHelper.Google)
     {
         SetUserInformationFromGoogle(response);
     }
     else
     {
         SetUserInformationGeneric(response);
     }
 }

		/// <summary>
		/// Gets the extra data obtained from the response message when authentication is successful.
		/// </summary>
		/// <param name="response">
		/// The response message. 
		/// </param>
		/// <returns>A dictionary of profile data; or null if no data is available.</returns>
		protected override NameValueCollection GetExtraData(IAuthenticationResponse response) {
			FetchResponse fetchResponse = response.GetExtension<FetchResponse>();
			if (fetchResponse != null) {
				var extraData = new NameValueCollection();
				extraData.AddItemIfNotEmpty("email", fetchResponse.GetAttributeValue(WellKnownAttributes.Contact.Email));
				extraData.AddItemIfNotEmpty("country", fetchResponse.GetAttributeValue(WellKnownAttributes.Contact.HomeAddress.Country));
				extraData.AddItemIfNotEmpty("firstName", fetchResponse.GetAttributeValue(WellKnownAttributes.Name.First));
				extraData.AddItemIfNotEmpty("lastName", fetchResponse.GetAttributeValue(WellKnownAttributes.Name.Last));

				return extraData;
			}

			return null;
		}