/// <summary>
		/// Processes an authentication request by a popup window.
		/// </summary>
		/// <param name="userIdentityPageBase">The base URI upon which user identity pages are created.</param>
		/// <param name="request">The incoming authentication request.</param>
		/// <param name="cancellationToken">The cancellation token.</param>
		/// <returns>
		/// A task that completes with the asynchronous operation.
		/// </returns>
		internal static async Task ProcessAuthenticationAsync(Uri userIdentityPageBase, IAuthenticationRequest request, CancellationToken cancellationToken) {
			Requires.NotNull(userIdentityPageBase, "userIdentityPageBase");
			Requires.NotNull(request, "request");

			var window = new CheckIdWindow(userIdentityPageBase, request);

			IHostFactories hostFactories = new DefaultOpenIdHostFactories();
			bool isRPDiscoverable = await request.IsReturnUrlDiscoverableAsync(hostFactories, cancellationToken) == RelyingPartyDiscoveryResult.Success;
			window.discoverableYesLabel.Visibility = isRPDiscoverable ? Visibility.Visible : Visibility.Collapsed;
			window.discoverableNoLabel.Visibility = isRPDiscoverable ? Visibility.Collapsed : Visibility.Visible;

			bool? result = window.ShowDialog();

			// If the user pressed Esc or cancel, just send a negative assertion.
			if (!result.HasValue || !result.Value) {
				request.IsAuthenticated = false;
				return;
			}

			request.IsAuthenticated = window.tabControl1.SelectedItem == window.positiveTab;
			if (request.IsAuthenticated.Value) {
				request.ClaimedIdentifier = window.claimedIdentifierBox.Text;
				request.LocalIdentifier = window.localIdentifierBox.Text;
			}
		}

        public IAuthenticationReply Authenticate(IAuthenticationRequest authenticationRequest)
        {
            var authenticationReply = new AuthenticationReply();

            this._traceManager.Trace("CA: Authentication Request Received", authenticationRequest);

            IEnumerable<User> users =
                this.UnitOfWork.Repository<User, int>()
                    .Query()
                    .Filter(p => p.Email.Equals(authenticationRequest.UserId, StringComparison.OrdinalIgnoreCase))
                    .Get();

            User user = users.FirstOrDefault();
            if (user != null)
            {
                var sessionKey = new byte[SessionKeyLength];
                this.GetRandomBytes(sessionKey);

                ITgsToken tgsToken = this.CreateTgsToken(sessionKey);
                ITgtToken tgtToken = this.CreateTgtToken(user, sessionKey);
                this._traceManager.Trace("CA: TGS Generate tokens", tgsToken, tgtToken);
                authenticationReply.TgsBytes = this.EncryptTgsToken(user, tgsToken);
                authenticationReply.TgtBytes = this.EncryptTgtToken(tgtToken);
                this._traceManager.Trace("CA: TGS Encrypt tokens", Tuple.Create(authenticationReply.TgsBytes, authenticationReply.TgtBytes));
            }
            else
            {
                authenticationReply.Message = "User not found.";
            }

            return authenticationReply;
        }

 /// <summary>
 /// Constructs an object with minimal information of an incomplete or failed
 /// authentication attempt.
 /// </summary>
 internal OpenIdEventArgs(IAuthenticationRequest request)
 {
     if (request == null) throw new ArgumentNullException("request");
     Request = request;
     ClaimedIdentifier = request.ClaimedIdentifier;
     IsDirectedIdentity = request.IsDirectedIdentity;
 }

 protected override void OnBeforeSendingAuthenticationRequest(IAuthenticationRequest request)
 {
     var fetchRequest = new FetchRequest();
     fetchRequest.Attributes.AddRequired(WellKnownAttributes.Contact.Email);
     fetchRequest.Attributes.AddRequired(WellKnownAttributes.Name.FullName);
     request.AddExtension(fetchRequest);
 }

		/// <summary>
		/// Initializes a new instance of the <see cref="OpenIdEventArgs"/> class
		/// with minimal information of an incomplete or failed authentication attempt.
		/// </summary>
		/// <param name="request">The outgoing authentication request.</param>
		internal OpenIdEventArgs(IAuthenticationRequest request) {
			Contract.Requires<ArgumentNullException>(request != null);

			this.Request = request;
			this.ClaimedIdentifier = request.ClaimedIdentifier;
			this.IsDirectedIdentity = request.IsDirectedIdentity;
		}

        public ActionResult Provider()
        {
            IRequest request = OpenIdProvider.GetRequest();
            if (request != null) {
                var authRequest = request as IAuthenticationRequest;
                if (authRequest != null) {
                    PendingAuthenticationRequest = authRequest;
                    if (authRequest.IsReturnUrlDiscoverable(OpenIdProvider) == RelyingPartyDiscoveryResult.Success &&
                        User.Identity.IsAuthenticated &&
                        (authRequest.IsDirectedIdentity || this.UserControlsIdentifier(authRequest))) {
                        return this.SendAssertion();
                    } else {
                        return RedirectToAction("LogOn", "Account", new { returnUrl = Url.Action("SendAssertion") });
                    }
                }

                if (request.IsResponseReady) {
                    return OpenIdProvider.PrepareResponse(request).AsActionResult();
                } else {
                    return RedirectToAction("LogOn", "Account");
                }
            } else {
                return View();
            }
        }

		/// <summary>
		/// Initializes a new instance of the <see cref="OpenIdEventArgs"/> class
		/// with minimal information of an incomplete or failed authentication attempt.
		/// </summary>
		/// <param name="request">The outgoing authentication request.</param>
		internal OpenIdEventArgs(IAuthenticationRequest request) {
			Requires.NotNull(request, "request");

			this.Request = request;
			this.ClaimedIdentifier = request.ClaimedIdentifier;
			this.IsDirectedIdentity = request.IsDirectedIdentity;
		}

		private void prepareRequest(IAuthenticationRequest request) {
			// Collect the PAPE policies requested by the user.
			List<string> policies = new List<string>();
			foreach (ListItem item in this.papePolicies.Items) {
				if (item.Selected) {
					policies.Add(item.Value);
				}
			}

			// Add the PAPE extension if any policy was requested.
			var pape = new PolicyRequest();
			if (policies.Count > 0) {
				foreach (string policy in policies) {
					pape.PreferredPolicies.Add(policy);
				}
			}

			if (this.maxAuthTimeBox.Text.Length > 0) {
				pape.MaximumAuthenticationAge = TimeSpan.FromSeconds(double.Parse(this.maxAuthTimeBox.Text));
			}

			if (pape.PreferredPolicies.Count > 0 || pape.MaximumAuthenticationAge.HasValue) {
				request.AddExtension(pape);
			}
		}

        internal static void ProcessAuthenticationChallenge(IAuthenticationRequest idrequest)
        {
            if (idrequest.Immediate) {
                if (idrequest.IsDirectedIdentity) {
                    if (HttpContext.Current.User.Identity.IsAuthenticated) {
                        idrequest.LocalIdentifier = Util.BuildIdentityUrl();
                        idrequest.IsAuthenticated = true;
                    } else {
                        idrequest.IsAuthenticated = false;
                    }
                } else {
                    string userOwningOpenIdUrl = Util.ExtractUserName(idrequest.LocalIdentifier);

                    // NOTE: in a production provider site, you may want to only
                    // respond affirmatively if the user has already authorized this consumer
                    // to know the answer.
                    idrequest.IsAuthenticated = userOwningOpenIdUrl == HttpContext.Current.User.Identity.Name;
                }

                if (idrequest.IsAuthenticated.Value) {
                    // add extension responses here.
                }
            } else {
                HttpContext.Current.Response.Redirect("~/decide.aspx", true);
            }
        }

 protected override void OnBeforeSendingAuthenticationRequest(IAuthenticationRequest request)
 {
     FetchRequest extension = new FetchRequest();
     extension.Attributes.AddRequired("http://axschema.org/contact/email");
     extension.Attributes.AddRequired("http://axschema.org/namePerson");
     request.AddExtension(extension);
 }

		/// <summary>
		/// Called just before the authentication request is sent to service provider.
		/// </summary>
		/// <param name="request">
		/// The request. 
		/// </param>
		protected override void OnBeforeSendingAuthenticationRequest(IAuthenticationRequest request) {
			// Attribute Exchange extensions
			var fetchRequest = new FetchRequest();
			fetchRequest.Attributes.Add(new AttributeRequest(WellKnownAttributes.Contact.Email, isRequired: true));
			fetchRequest.Attributes.Add(new AttributeRequest(WellKnownAttributes.Name.FullName, isRequired: false));

			request.AddExtension(fetchRequest);
		}

        IAuthenticationResult IApplicationSync.AuthenticateAccount(IAuthenticationRequest request, Action<IRetrievalOptions<IAuthenticationResult>> responseOptions)
        {
            var options = new DefaultRetrievalOptions<IAuthenticationResult>();
            responseOptions(options);

            var dispatcher = new AuthenticationRequestDispatcher();

            return dispatcher.Authenticate(this.GetInternalSyncDataStore(), this, request, options);
        }

        Task<IAuthenticationResult> IApplication.AuthenticateAccountAsync(IAuthenticationRequest request, Action<IRetrievalOptions<IAuthenticationResult>> responseOptions, CancellationToken cancellationToken)
        {
            var options = new DefaultRetrievalOptions<IAuthenticationResult>();
            responseOptions(options);

            var dispatcher = new AuthenticationRequestDispatcher();

            return dispatcher.AuthenticateAsync(this.GetInternalAsyncDataStore(), this, request, options, cancellationToken);
        }

        public Task<IAuthenticationResult> AuthenticateAsync(string parentHref, IAuthenticationRequest request, IRetrievalOptions<IAuthenticationResult> options, CancellationToken cancellationToken)
        {
            Validate(parentHref, request);

            var attempt = this.BuildRequest(parentHref, request);
            var href = $"{parentHref}/loginAttempts";

            return this.dataStoreAsync.CreateAsync<IBasicLoginAttempt, IAuthenticationResult>(href, attempt, options, null, cancellationToken);
        }

		/// <summary>
		/// Called just before the authentication request is sent to service provider.
		/// </summary>
		/// <param name="request">
		/// The request. 
		/// </param>
		protected override void OnBeforeSendingAuthenticationRequest(IAuthenticationRequest request) {
			// Attribute Exchange extensions
			var fetchRequest = new FetchRequest();
			fetchRequest.Attributes.AddRequired(WellKnownAttributes.Contact.Email);
			fetchRequest.Attributes.AddOptional(WellKnownAttributes.Contact.HomeAddress.Country);
			fetchRequest.Attributes.AddOptional(WellKnownAttributes.Name.First);
			fetchRequest.Attributes.AddOptional(WellKnownAttributes.Name.Last);

			request.AddExtension(fetchRequest);
		}

		/// <summary>
		/// Attaches an OAuth authorization request to an outgoing OpenID authentication request.
		/// </summary>
		/// <param name="openIdAuthenticationRequest">The OpenID authentication request.</param>
		/// <param name="scope">The scope of access that is requested of the service provider.</param>
		public void AttachAuthorizationRequest(IAuthenticationRequest openIdAuthenticationRequest, string scope) {
			Requires.NotNull(openIdAuthenticationRequest, "openIdAuthenticationRequest");

			var authorizationRequest = new AuthorizationRequest {
				Consumer = this.ConsumerKey,
				Scope = scope,
			};

			openIdAuthenticationRequest.AddExtension(authorizationRequest);
		}

        public IAuthenticationResult Authenticate(IInternalDataStore dataStore, IApplication application, IAuthenticationRequest request, IRetrievalOptions<IAuthenticationResult> options)
        {
            Validate(dataStore, application, request);

            if (request is UsernamePasswordRequest)
            {
                return new BasicAuthenticator(dataStore).Authenticate(application.Href, request, options);
            }

            throw new InvalidOperationException($"The AuthenticationRequest {request.GetType().Name} is not supported by this implementation.");
        }

        /// <summary>
        /// Attaches an OAuth authorization request to an outgoing OpenID authentication request.
        /// </summary>
        /// <param name="openIdAuthenticationRequest">The OpenID authentication request.</param>
        /// <param name="scope">The scope of access that is requested of the service provider.</param>
        public void AttachAuthorizationRequest(IAuthenticationRequest openIdAuthenticationRequest, string scope)
        {
            Contract.Requires(openIdAuthenticationRequest != null);
            ErrorUtilities.VerifyArgumentNotNull(openIdAuthenticationRequest, "openIdAuthenticationRequest");

            var authorizationRequest = new AuthorizationRequest {
                Consumer = this.ConsumerKey,
                Scope = scope,
            };

            openIdAuthenticationRequest.AddExtension(authorizationRequest);
        }

        private static void Validate(string parentHref, IAuthenticationRequest request)
        {
            if (string.IsNullOrEmpty(parentHref))
            {
                throw new ArgumentNullException(nameof(parentHref));
            }

            if (!(request is UsernamePasswordRequest))
            {
                throw new ArgumentException("Only UsernamePasswordRequest instances are supported by this by this authenticator.");
            }
        }

    public void ProcessRequest(HttpContext context) {
       var sregRequest = ProviderEndpoint.PendingAuthenticationRequest.GetExtension<ClaimsRequest>();
       ClaimsResponse sregResponse = null;
       if (sregRequest != null)
       {
          //sregResponse = profileFields.GetOpenIdProfileFields(sregRequest);
       }
       ProviderEndpoint.PendingAuthenticationRequest.IsAuthenticated = true;
       if (sregResponse != null)
       {
          ProviderEndpoint.PendingAuthenticationRequest.AddResponseExtension(sregResponse);
       }
       //Debug.Assert(ProviderEndpoint.PendingAuthenticationRequest.IsResponseReady);
       ProviderEndpoint.PendingAuthenticationRequest.Response.Send();
       ProviderEndpoint.PendingAuthenticationRequest = null;


      OpenIdProvider provider = new OpenIdProvider();
      if (provider.Request != null) {
        // Some OpenID requests are automatable and can be responded to immediately.
        if (!provider.Request.IsResponseReady) {
          // But authentication requests cannot be responded to until something on
          // this site decides whether to approve or disapprove the authentication.
          var idrequest = (IAuthenticationRequest)provider.Request;
          // We store the authentication request in the user's session so that
          // redirects and user prompts can appear and eventually some page can decide
          // to respond to the OpenID authentication request either affirmatively or
          // negatively.
          PendingAuthenticationRequest = idrequest;
          // We delegate that approval process to our utility method that we share
          // with our other Provider sample page server.aspx.
          Util.ProcessAuthenticationChallenge(idrequest);
          // As part of authentication approval, the user may need to authenticate
          // to this Provider and/or decide whether to allow the requesting RP site
          // to log this user in.  If any UI needs to be presented to the user, 
          // the previous call to ProcessAuthenticationChallenge MAY not return
          // due to a redirect to some ASPX page.
        } else {
          // Some other automatable OpenID request is coming down, so clear
          // any previously session stored authentication request that might be
          // stored for this user.
          PendingAuthenticationRequest = null;
        }
        // Whether this was an automated message or an authentication message,
        // if there is a response ready to send back immediately, do so.
        if (provider.Request.IsResponseReady) {
          provider.Request.Response.Send();
          PendingAuthenticationRequest = null;
        }
      }
    }