/// <summary>
        /// Remove the Users Session
        /// </summary>
        /// <param name="service"></param>
        /// <param name="request"></param>
        /// <returns></returns>
        public virtual object Logout(IServiceBase service, Authenticate request)
        {
            var feature = HostContext.GetPlugin<AuthFeature>();

            var session = service.GetSession();
            var referrerUrl = (request != null ? request.Continue : null)
                ?? (feature.HtmlLogoutRedirect != null ? service.Request.ResolveAbsoluteUrl(feature.HtmlLogoutRedirect) : null)
                ?? session.ReferrerUrl
                ?? service.Request.GetHeader("Referer")
                ?? this.CallbackUrl;

            session.OnLogout(service);
            AuthEvents.OnLogout(service.Request, session, service);

            service.RemoveSession();

            if (feature != null && feature.DeleteSessionCookiesOnLogout)
            {
                service.Request.Response.DeleteSessionCookies();
            }

            if (service.Request.ResponseContentType == MimeTypes.Html && !string.IsNullOrEmpty(referrerUrl))
                return service.Redirect(LogoutUrlFilter(this, referrerUrl.SetParam("s", "-1")));

            return new AuthenticateResponse();
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            IAuthTokens tokens = Init(authService, ref session, request);
            IRequest httpRequest = authService.Request;


            string error = httpRequest.QueryString["error"]
                           ?? httpRequest.QueryString["error_uri"]
                           ?? httpRequest.QueryString["error_description"];

            bool hasError = !error.IsNullOrEmpty();
            if (hasError)
            {
                Log.Error($"Yandex error callback. {httpRequest.QueryString}");
                return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", error)));
            }

            string code = httpRequest.QueryString["code"];
            bool isPreAuthCallback = !code.IsNullOrEmpty();
            if (!isPreAuthCallback)
            {
                string preAuthUrl = $"{PreAuthUrl}?response_type=code&client_id={ApplicationId}&redirect_uri={CallbackUrl.UrlEncode()}&display=popup&state={Guid.NewGuid().ToString("N")}";
                this.SaveSession(authService, session, SessionExpiry);
                return authService.Redirect(PreAuthUrlFilter(this, preAuthUrl));
            }

            try
            {
                string payload = $"grant_type=authorization_code&code={code}&client_id={ApplicationId}&client_secret={ApplicationPassword}";
                string contents = AccessTokenUrl.PostStringToUrl(payload);

                var authInfo = JsonObject.Parse(contents);

                //Yandex does not throw exception, but returns error property in JSON response
                // http://api.yandex.ru/oauth/doc/dg/reference/obtain-access-token.xml
                string accessTokenError = authInfo.Get("error");

                if (!accessTokenError.IsNullOrEmpty())
                {
                    Log.Error($"Yandex access_token error callback. {authInfo}");
                    return authService.Redirect(session.ReferrerUrl.SetParam("f", "AccessTokenFailed"));
                }
                tokens.AccessTokenSecret = authInfo.Get("access_token");

                session.IsAuthenticated = true;

                return OnAuthenticated(authService, session, tokens, authInfo.ToDictionary())
                    ?? authService.Redirect(SuccessRedirectUrlFilter(this, session.ReferrerUrl.SetParam("s", "1")));
            }
            catch (WebException webException)
            {
                //just in case Yandex will start throwing exceptions 
                var statusCode = ((HttpWebResponse)webException.Response).StatusCode;
                if (statusCode == HttpStatusCode.BadRequest)
                {
                    return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", "AccessTokenFailed")));
                }
            }
            return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", "Unknown")));
        }

        public override string ToString()
        {
            a = (Authenticate)base.Tag;

            Binding myBinding = new Binding("password");
            myBinding.Mode = BindingMode.TwoWay;
            myBinding.Source = a;
            txtpass.SetBinding(TextBox.TextProperty, myBinding);

            Binding myBinding2 = new Binding("options");
            myBinding2.Mode = BindingMode.TwoWay;
            myBinding2.Source = a;
            txtopt.SetBinding(TextBox.TextProperty, myBinding2);

            Binding myBinding3 = new Binding("maxdigits");
            myBinding3.Mode = BindingMode.TwoWay;
            myBinding3.Source = a;
            txtmax.SetBinding(TextBox.TextProperty, myBinding3);

            Binding myBinding4 = new Binding("prompt");
            myBinding4.Mode = BindingMode.TwoWay;
            myBinding4.Source = a;
            txtprompt.SetBinding(TextBox.TextProperty, myBinding4);



            Binding descbinding = new Binding("Description");
            descbinding.Mode = BindingMode.TwoWay;
            descbinding.Source = a;
            txtdesc.SetBinding(TextBox.TextProperty, descbinding);


            return base.ToString();
        }

        /// <summary>
        /// Parse a message value.
        /// </summary>
        /// <param name="name">Name of header being parsed.</param>
        /// <param name="reader">Reader containing the string that should be parsed.</param>
        /// <returns>Newly created header.</returns>
        /// <exception cref="ParseException">Header value is malformed.</exception>
        /// <example>
        /// Digest realm="atlanta.com",
        /// domain="sip:boxesbybob.com", qop="auth",
        /// nonce="f84f1cec41e6cbe5aea9c8e88d359",
        /// opaque="", stale=FALSE, algorithm=MD5
        /// </example>
        public IHeader Parse(string name, ITextReader reader)
        {
            reader.ConsumeWhiteSpaces();
            string digest = reader.ReadWord().ToLower();
            if (digest != "digest")
                throw new ParseException("Authorization header is not digest authentication");

            reader.ConsumeWhiteSpaces();
            var parameters = new KeyValueCollection();
            UriParser.ParseParameters(parameters, reader, ',');

            var header = new Authenticate(name)
                             {
                                 Algortihm = parameters["algorithm"],
                                 Domain = UriParser.Parse(parameters["domain"]),
                                 Realm = parameters["realm"],
                                 Nonce = parameters["nonce"],
                                 Qop = parameters["qop"],
                                 Opaque = parameters["opaque"]
                             };

            try
            {
                header.Stale = bool.Parse(parameters["stale"]);
            }
            catch (Exception err)
            {
                throw new ParseException("Failed to parse 'stale' in WWW-Authenticate header.", err);
            }

            return header;
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            var user = authService.Request.GetUser();
            var userName = user.GetUserName();
            if (!LoginMatchesSession(session, userName))
            {
                authService.RemoveSession();
                session = authService.GetSession();
            }

            if (IsAuthorized(user))
            {
                session.IsAuthenticated = true;
                if (session.UserAuthName == null)
                {
                    session.UserAuthName = userName;
                }

                var aspReq = (HttpRequestBase)authService.Request.OriginalRequest;

                var loginUser = aspReq.ServerVariables["LOGON_USER"].ToNullIfEmpty();
                var remoteUser = aspReq.ServerVariables["REMOTE_USER"].ToNullIfEmpty();
                var identityName = aspReq.LogonUserIdentity != null ? aspReq.LogonUserIdentity.Name : null;
                session.DisplayName = loginUser
                    ?? remoteUser
                    ?? identityName;

                var tokens = new AuthTokens {
                    Provider = Name,
                    UserName = userName,
                    DisplayName = session.DisplayName,
                    Items = new Dictionary<string, string> {
                        {"LOGON_USER", loginUser},
                        {"REMOTE_USER", remoteUser},
                        {"LogonUserIdentityName", identityName},
                    }
                };

                if (session.Roles == null)
                    session.Roles = new List<string>();

                foreach (var role in AllRoles.Safe())
                {
                    if (user.IsInRole(role))
                        session.Roles.AddIfNotExists(role);
                }

                OnAuthenticated(authService, session, tokens, new Dictionary<string, string>());

                return new AuthenticateResponse
                {
                    UserName = userName,
                    SessionId = session.Id,
                    DisplayName = session.DisplayName,
                    ReferrerUrl = request.Continue
                };
            }

            throw HttpError.Unauthorized("Windows Auth failed");
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            IAuthTokens tokens = Init(authService, ref session, request);
            IRequest httpRequest = authService.Request;


            string error = httpRequest.QueryString["error"];

            bool hasError = !error.IsNullOrEmpty();
            if (hasError)
            {
                Log.Error($"Odnoklassniki error callback. {httpRequest.QueryString}");
                return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", error)));
            }

            string code = httpRequest.QueryString["code"];
            bool isPreAuthCallback = !code.IsNullOrEmpty();
            if (!isPreAuthCallback)
            {
                string preAuthUrl = $"{PreAuthUrl}?client_id={ApplicationId}&redirect_uri={CallbackUrl.UrlEncode()}&response_type=code&layout=m";

                this.SaveSession(authService, session, SessionExpiry);
                return authService.Redirect(PreAuthUrlFilter(this, preAuthUrl));
            }

            try
            {
                string payload = $"client_id={ApplicationId}&client_secret={SecretKey}&code={code}&redirect_uri={CallbackUrl.UrlEncode()}&grant_type=authorization_code";

                string contents = AccessTokenUrlFilter(this, AccessTokenUrl).PostToUrl(payload, "*/*", RequestFilter);

                var authInfo = JsonObject.Parse(contents);

                //ok.ru does not throw exception, but returns error property in JSON response
                string accessTokenError = authInfo.Get("error");

                if (!accessTokenError.IsNullOrEmpty())
                {
                    Log.Error($"Odnoklassniki access_token error callback. {authInfo}");
                    return authService.Redirect(session.ReferrerUrl.SetParam("f", "AccessTokenFailed"));
                }
                tokens.AccessTokenSecret = authInfo.Get("access_token");
                tokens.UserId = authInfo.Get("user_id");

                session.IsAuthenticated = true;

                return OnAuthenticated(authService, session, tokens, authInfo.ToDictionary())
                    ?? authService.Redirect(SuccessRedirectUrlFilter(this, session.ReferrerUrl.SetParam("s", "1")));
            }
            catch (WebException webException)
            {
                //just in case it starts throwing exceptions 
                HttpStatusCode statusCode = ((HttpWebResponse)webException.Response).StatusCode;
                if (statusCode == HttpStatusCode.BadRequest)
                {
                    return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", "AccessTokenFailed")));
                }
            }
            return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", "Unknown")));
        }

        protected IAuthTokens Init(IServiceBase authService, ref IAuthSession session, Authenticate request)
        {
            Logger.Debug("SamlAuthProvider::Init:ENTER");
            if (this.CallbackUrl.IsNullOrEmpty())
            {
                this.CallbackUrl = authService.Request.AbsoluteUri;
                Logger.Debug("CallbackUrl was null, setting to: {0}".Fmt(this.CallbackUrl));
            }

            if (session.ReferrerUrl.IsNullOrEmpty() && authService.Request != null && authService.Request.Verb == "POST")
            {
                session.ReferrerUrl = this.IdpInitiatedRedirect;
            }
            else {
                session.ReferrerUrl = GetReferrerUrl(authService, session, request);
            }
            Logger.Debug("Session ReferrerUrl Set to: {0}".Fmt(session.ReferrerUrl));

            var tokens = session.ProviderOAuthAccess.FirstOrDefault(x => x.Provider == this.Provider);
            if (tokens == null)
            {
                Logger.Debug("Tokens were null, initializing");
                session.ProviderOAuthAccess.Add(tokens = new AuthTokens { Provider = this.Provider });                
            }
            Logger.Debug("Tokens contains");
            Logger.Debug(tokens.ToJson());
            Logger.Debug("SamlAuthProvider::Init:RETURN");
            return tokens;
        }

 public void doLogin()
 {
     // TODO: add loading while processing
     // authenticate
     Authenticate auth = new Authenticate ();
     auth.login (_username.text, _password.text);
     // TODO: show error if failed
 }

        public override bool IsAuthorized(IAuthSession session, IAuthTokens tokens, Authenticate request = null)
        {
            if (request != null)
            {
                if (!LoginMatchesSession(session, request.UserName)) return false;
            }

            return tokens != null && !string.IsNullOrEmpty(tokens.AccessTokenSecret);
        }

        public override bool IsAuthorized(IAuthSession session, IAuthTokens tokens, Authenticate request = null)
        {
            if (request != null) {
                if (!LoginMatchesSession(session, request.UserName)) {
                    return false;
                }
            }

            return !session.UserAuthName.IsNullOrEmpty();
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            var tokens = Init(authService, ref session, request);
            var httpRequest = authService.Request;

            var error = httpRequest.QueryString["error_reason"]
                ?? httpRequest.QueryString["error"]
                ?? httpRequest.QueryString["error_code"]
                ?? httpRequest.QueryString["error_description"];

            var hasError = !error.IsNullOrEmpty();
            if (hasError)
            {
                Log.Error("Facebook error callback. {0}".Fmt(httpRequest.QueryString));
                return authService.Redirect(session.ReferrerUrl);
            }             
        
            var code = httpRequest.QueryString["code"];
            var isPreAuthCallback = !code.IsNullOrEmpty();
            if (!isPreAuthCallback)
            {
                var preAuthUrl = PreAuthUrl + "?client_id={0}&redirect_uri={1}&scope={2}"
                    .Fmt(AppId, this.CallbackUrl.UrlEncode(), string.Join(",", Permissions));

                authService.SaveSession(session, SessionExpiry);
                return authService.Redirect(preAuthUrl);
            }

            var accessTokenUrl = this.AccessTokenUrl + "?client_id={0}&redirect_uri={1}&client_secret={2}&code={3}"
                .Fmt(AppId, this.CallbackUrl.UrlEncode(), AppSecret, code);

            try
            {
                var contents = accessTokenUrl.GetStringFromUrl();
                var authInfo = HttpUtility.ParseQueryString(contents);
                tokens.AccessTokenSecret = authInfo["access_token"];
                session.IsAuthenticated = true;
                authService.SaveSession(session, SessionExpiry);
                OnAuthenticated(authService, session, tokens, authInfo.ToDictionary());

                //Haz access!
                return authService.Redirect(session.ReferrerUrl.AddHashParam("s", "1"));
            }
            catch (WebException we)
            {
                var statusCode = ((HttpWebResponse)we.Response).StatusCode;
                if (statusCode == HttpStatusCode.BadRequest)
                {
                    return authService.Redirect(session.ReferrerUrl.AddHashParam("f", "AccessTokenFailed"));
                }
            }

            //Shouldn't get here
            return authService.Redirect(session.ReferrerUrl.AddHashParam("f", "Unknown"));
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            var httpReq = authService.RequestContext.Get<IHttpRequest>();
            var basicAuth = httpReq.GetBasicAuthUserAndPassword();
            if (basicAuth == null)
                throw HttpError.Unauthorized("Invalid BasicAuth credentials");

            var userName = basicAuth.Value.Key;
            var password = basicAuth.Value.Value;

            return Authenticate(authService, session, userName, password, request.Continue);
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            var tokens = Init(authService, ref session, request);
            var httpRequest = authService.Request;

            var error = httpRequest.QueryString["error_reason"]
                ?? httpRequest.QueryString["error"]
                ?? httpRequest.QueryString["error_code"]
                ?? httpRequest.QueryString["error_description"];

            var hasError = !error.IsNullOrEmpty();
            if (hasError)
            {
                Log.Error($"Facebook error callback. {httpRequest.QueryString}");
                return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", error)));
            }             
        
            var code = httpRequest.QueryString["code"];
            var isPreAuthCallback = !code.IsNullOrEmpty();
            if (!isPreAuthCallback)
            {
                var preAuthUrl = $"{PreAuthUrl}?client_id={AppId}&redirect_uri={this.CallbackUrl.UrlEncode()}&scope={string.Join(",", Permissions)}";

                this.SaveSession(authService, session, SessionExpiry);
                return authService.Redirect(PreAuthUrlFilter(this, preAuthUrl));
            }

            var accessTokenUrl = $"{AccessTokenUrl}?client_id={AppId}&redirect_uri={this.CallbackUrl.UrlEncode()}&client_secret={AppSecret}&code={code}";

            try
            {
                var contents = AccessTokenUrlFilter(this, accessTokenUrl).GetJsonFromUrl();
                var authInfo = JsonObject.Parse(contents);
                tokens.AccessTokenSecret = authInfo["access_token"];

                session.IsAuthenticated = true;
                
                return OnAuthenticated(authService, session, tokens, authInfo.ToDictionary())
                    ?? authService.Redirect(SuccessRedirectUrlFilter(this, session.ReferrerUrl.SetParam("s", "1"))); //Haz access!
            }
            catch (WebException we)
            {
                var statusCode = ((HttpWebResponse)we.Response).StatusCode;
                if (statusCode == HttpStatusCode.BadRequest)
                {
                    return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", "AccessTokenFailed")));
                }
            }

            //Shouldn't get here
            return authService.Redirect(FailedRedirectUrlFilter(this, session.ReferrerUrl.SetParam("f", "Unknown")));
        }

        public override bool IsAuthorized(IAuthSession session, IAuthTokens tokens, Authenticate request = null)
        {
            if (request != null)
            {
                //if (!LoginMatchesSession(session, request.UserName))
                //{
                //	return false;
                //}
                throw new NotImplementedException();
            }

            return session != null && session.IsAuthenticated && !session.UserAuthName.IsNullOrEmpty();
        }

        /// <summary>
        /// Remove the Users Session
        /// </summary>
        /// <param name="service"></param>
        /// <param name="request"></param>
        /// <returns></returns>
        public virtual object Logout(IServiceBase service, Authenticate request)
        {
            var session = service.GetSession();
            var referrerUrl = (request != null ? request.Continue : null)
                ?? session.ReferrerUrl
                ?? service.RequestContext.GetHeader("Referer")
                ?? this.CallbackUrl;

            session.OnLogout(service);

            service.RemoveSession();

            if (service.RequestContext.ResponseContentType == MimeTypes.Html && !String.IsNullOrEmpty(referrerUrl))
                return service.Redirect(referrerUrl.AddHashParam("s", "-1"));

            return new AuthenticateResponse();
        }

        /// <summary>
        /// The entry point for all AuthProvider providers. Runs inside the AuthService so exceptions are treated normally.
        /// Overridable so you can provide your own Auth implementation.
        /// </summary>
        /// <param name="authService"></param>
        /// <param name="session"></param>
        /// <param name="request"></param>
        /// <returns></returns>
        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            var tokens = Init(authService, ref session, request);

            //Default OAuth logic based on Twitter's OAuth workflow
            if (!tokens.RequestToken.IsNullOrEmpty() && !request.oauth_token.IsNullOrEmpty())
            {
                OAuthUtils.RequestToken = tokens.RequestToken;
                OAuthUtils.RequestTokenSecret = tokens.RequestTokenSecret;
                OAuthUtils.AuthorizationToken = request.oauth_token;
                OAuthUtils.AuthorizationVerifier = request.oauth_verifier;

                if (OAuthUtils.AcquireAccessToken())
                {
                    tokens.AccessToken = OAuthUtils.AccessToken;
                    tokens.AccessTokenSecret = OAuthUtils.AccessTokenSecret;
                    session.IsAuthenticated = true;
                    OnAuthenticated(authService, session, tokens, OAuthUtils.AuthInfo);
                    authService.SaveSession(session, SessionExpiry);

                    //Haz access!
                    return authService.Redirect(session.ReferrerUrl.AddHashParam("s", "1"));
                }

                //No Joy :(
                tokens.RequestToken = null;
                tokens.RequestTokenSecret = null;
                authService.SaveSession(session, SessionExpiry);
                return authService.Redirect(session.ReferrerUrl.AddHashParam("f", "AccessTokenFailed"));
            }
            if (OAuthUtils.AcquireRequestToken())
            {
                tokens.RequestToken = OAuthUtils.RequestToken;
                tokens.RequestTokenSecret = OAuthUtils.RequestTokenSecret;
                authService.SaveSession(session, SessionExpiry);

                //Redirect to OAuth provider to approve access
                return authService.Redirect(this.AuthorizeUrl
                    .AddQueryParam("oauth_token", tokens.RequestToken)
                    .AddQueryParam("oauth_callback", session.ReferrerUrl));
            }

            return authService.Redirect(session.ReferrerUrl.AddHashParam("f", "RequestTokenFailed"));
        }

        public override object Authenticate(IServiceBase authService, IAuthSession session, Authenticate request)
        {
            var header = request.oauth_token;
           
            // if no auth header, 401
            if (string.IsNullOrEmpty(header))
            {
                throw HttpError.Unauthorized(MissingAuthHeader);
            }

            var headerData = header.Split(' ');

            // if header is missing bearer portion, 401
            if (string.Compare(headerData[0], "BEARER", StringComparison.OrdinalIgnoreCase) != 0)
            {
                throw HttpError.Unauthorized(InvalidAuthHeader);
            }

            try
            {
               
                // set current principal to the validated token principal
                Thread.CurrentPrincipal = JsonWebToken.ValidateToken(headerData[1], Certificate,  Audience,  Issuer);

                if (HttpContext.Current != null)
                {
                    // set the current request's user the the decoded principal
                    HttpContext.Current.User = Thread.CurrentPrincipal;
                }

                // set the session's username to the logged in user
                session.UserName = Thread.CurrentPrincipal.Identity.Name;

                return OnAuthenticated(authService, session, new AuthTokens(), new Dictionary<string, string>());
            }
            catch (Exception ex)
            {
                throw new HttpError(HttpStatusCode.Unauthorized, ex);
            }
        }

 public void Options(Authenticate request) { }

        public object Delete(Authenticate request)
        {
            if (ValidateFn != null)
            {
                var response = ValidateFn(this, HttpMethods.Delete, request);
                if (response != null) return response;
            }

            this.RemoveSession();

            return new AuthenticateResponse();
        }

 /// <summary>
 /// The specified <paramref name="session"/> may change as a side-effect of this method. If
 /// subsequent code relies on current <see cref="IAuthSession"/> data be sure to reload
 /// the session istance via <see cref="ServiceExtensions.GetSession(IServiceBase,bool)"/>.
 /// </summary>
 private object Authenticate(Authenticate request, string provider, IAuthSession session, IAuthProvider oAuthConfig)
 {
     object response = null;
     if (!oAuthConfig.IsAuthorized(session, session.GetOAuthTokens(provider), request))
     {
         response = oAuthConfig.Authenticate(this, session, request);
     }
     return response;
 }