public IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var userName = principal.Identity.Name;
            var claims = new List<Claim>(from c in principal.Claims select c);

            // email address
            string email = Membership.FindUsersByName(userName)[userName].Email;
            if (!String.IsNullOrEmpty(email))
            {
                claims.Add(new Claim(ClaimTypes.Email, email));
            }

            // roles
            GetRolesForToken(userName).ToList().ForEach(role => claims.Add(new Claim(ClaimTypes.Role, role)));

            // profile claims
            if (ProfileManager.Enabled)
            {
                var profile = ProfileBase.Create(userName, true);
                if (profile != null)
                {
                    foreach (SettingsProperty prop in ProfileBase.Properties)
                    {
                        string value = profile.GetPropertyValue(prop.Name).ToString();
                        if (!String.IsNullOrWhiteSpace(value))
                        {
                            claims.Add(new Claim(ProfileClaimPrefix + prop.Name.ToLowerInvariant(), value));
                        }
                    }
                }
            }

            return claims;
        }

        public virtual IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var userName = principal.Identity.Name;
            var claims = new List<Claim>(from c in principal.Claims select c);

            var nameIdClaim = claims.FirstOrDefault(c => c.Type == ClaimTypes.NameIdentifier);
            if (nameIdClaim == null)
            {
                claims.Add(new Claim(ClaimTypes.NameIdentifier, userName));
            }

            // email address
            var membership = Membership.FindUsersByName(userName)[userName];
            if (membership != null)
            {
                string email = membership.Email;
                if (!String.IsNullOrEmpty(email))
                {
                    claims.Add(new Claim(ClaimTypes.Email, email));
                }
            }

            // roles
            GetRolesForToken(userName).ToList().ForEach(role => claims.Add(new Claim(ClaimTypes.Role, role)));

            // profile claims
            claims.AddRange(GetProfileClaims(userName));

            return claims;
        }

 public IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
 {
     return new List<Claim>
     {
         principal.Identities.First().FindFirst(ClaimTypes.Name),
         new Claim("http://claims/custom/foo", "bar")
     };
 }

        public IEnumerable<Claim> GetClaims(IClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var claims = from c in NewContext.UserClaims
                         where c.PartitionKey == principal.Identity.Name.ToLower() &&
                               c.Kind == UserClaimEntity.EntityKind
                         select new Claim(c.ClaimType, c.Value);

            return claims.ToList();
        }

        public RequestDetails Analyze(RequestSecurityToken rst, ClaimsPrincipal principal)
        {
            if (rst == null)
            {
                throw new ArgumentNullException("rst");
            }

            if (principal == null)
            {
                throw new ArgumentNullException("principal");
            }

            Tracing.Information("Starting PolicyOptions creation");

            var clientIdentity = AnalyzeClientIdentity(principal);

            var details = new RequestDetails
            {
                ClientIdentity = clientIdentity,
                IsActive = false,
                Realm = null,
                IsKnownRealm = false,
                UsesSsl = false,
                UsesEncryption = false,
                ReplyToAddress = null,
                ReplyToAddressIsWithinRealm = false,
                IsReplyToFromConfiguration = false,
                EncryptingCertificate = null,
                ClaimsRequested = false,
                RequestClaims = null,
                Request = null,
                IsActAsRequest = false,
                RelyingPartyRegistration = null
            };

            AnalyzeRst(rst, details);
            AnalyzeTokenType(rst, details);
            AnalyzeKeyType(rst);
            AnalyzeRealm(rst, details);
            AnalyzeOperationContext(details);
            AnalyzeDelegation(rst, details);
            AnalyzeRelyingParty(details);
            AnalyzeEncryption(details);
            AnalyzeReplyTo(details);
            AnalyzeSsl(details);
            AnalyzeRequestClaims(details);

            Tracing.Information("PolicyOptions creation done.");

            _details = details;
            return details;
        }

        public IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var claims = new List<Claim>();
            var nameClaim = principal.Identities.First().FindFirst(ClaimTypes.Name);
            claims.Add(nameClaim);
            var response = RewardService.GetRewardProgram(new GetRewardProgramRequest {UserName = nameClaim.Value});
            if(response != null)
            {
                claims.Add(new Claim("http://oceanicairlines.com/rewardlevel/", response.RewardLevel.ToString()));
            };

            return claims;
        }

        HttpResponseMessage Get()
        {
            var requestClaims = new RequestClaimCollection();

            var scopes = ClaimsPrincipal.Current.FindAll(OAuth2Constants.Scope);
            foreach (var scope in scopes)
            {
                if (OidcConstants.Mappings.ContainsKey(scope.Value))
                {
                    foreach (var oidcClaim in OidcConstants.Mappings[scope.Value])
                    {
                        requestClaims.Add(new RequestClaim(oidcClaim));
                    }
                }
                else
                {
                    Request.CreateErrorResponse(HttpStatusCode.BadRequest, "invalid scope");
                }
            }

            var details = new RequestDetails { IsOpenIdRequest = true };
            details.ClaimsRequested = true;
            details.RequestClaims = requestClaims;

            var principal = Principal.Create("OpenIdConnect",
                new Claim(ClaimTypes.NameIdentifier, ClaimsPrincipal.Current.FindFirst("sub").Value));

            var claims = ClaimsRepository.GetClaims(principal, details);

            var dictionary = new Dictionary<string, string>();
            foreach (var claim in claims)
            {
                if (!dictionary.ContainsKey(claim.Type))
                {
                    dictionary.Add(claim.Type, claim.Value);
                }
                else
                {
                    var currentValue = dictionary[claim.Type];
                    dictionary[claim.Type] = currentValue += ("," + claim.Value);
                }
            }

            return Request.CreateResponse<Dictionary<string, string>>(HttpStatusCode.OK, dictionary, "application/json");
        }

        public RequestDetailsScope(RequestDetails details, SigningCredentials signingCredentials, bool requireEncryption)
            : base(details.Realm.Uri.AbsoluteUri, signingCredentials)
        {
            RequestDetails = details;

            if (RequestDetails.UsesEncryption)
            {
                EncryptingCredentials = new X509EncryptingCredentials(details.EncryptingCertificate);
            }

            if (RequestDetails.TokenType == SimpleWebToken.OasisTokenProfile)
            {
                SigningCredentials = new SymmetricSigningCredentials(details.RelyingPartyRegistration.SymmetricSigningKey);
            }

            ReplyToAddress = RequestDetails.ReplyToAddress.AbsoluteUri;
            TokenEncryptionRequired = requireEncryption;
        }

        public HttpResponseMessage Get()
        {
            Tracing.Start("OIDC UserInfo endpoint");

            var details = new RequestDetails { IsOpenIdRequest = true };
            var scopeClaims = ClaimsPrincipal.Current.FindAll(OAuth2Constants.Scope).ToList();
            var requestedClaims = ClaimsPrincipal.Current.FindAll("requestclaim").ToList();

            if (scopeClaims.Count > 0)
            {
                var scopes = new List<string>(scopeClaims.Select(sc => sc.Value));
                details.OpenIdScopes = scopes;
            }

            if (requestedClaims.Count > 0)
            {
                var requestClaims = new RequestClaimCollection();
                requestedClaims.ForEach(rc => requestClaims.Add(new RequestClaim(rc.Value)));
                
                details.ClaimsRequested = true;
                details.RequestClaims = requestClaims;
            }

            var principal = Principal.Create("OpenIdConnect",
                new Claim(ClaimTypes.Name, ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value));

            var claims = ClaimsRepository.GetClaims(principal, details);

            var dictionary = new Dictionary<string, string>();
            foreach (var claim in claims)
            {
                if (!dictionary.ContainsKey(claim.Type))
                {
                    dictionary.Add(claim.Type, claim.Value);
                }
                else
                {
                    var currentValue = dictionary[claim.Type];
                    dictionary[claim.Type] = currentValue += ("," + claim.Value);
                }
            }

            return Request.CreateResponse<Dictionary<string, string>>(HttpStatusCode.OK, dictionary, "application/json");
        }

        public virtual IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var userName = principal.Identity.Name;
            var claims = new List<Claim>(from c in principal.Claims select c);

            // email address
            string email = userName;
            if (!String.IsNullOrEmpty(email))
            {
                    claims.Add(new Claim(ClaimTypes.Email, email));                
            }

            // roles
            GetRolesForToken(userName).ToList().ForEach(role => claims.Add(new Claim(ClaimTypes.Role, role)));

            // profile claims
            claims.AddRange(GetProfileClaims(userName));
            return claims;
        }

        virtual public IEnumerable<Claim> GetClaims(IClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var claims = new List<Claim>();

            using (PrincipalContext context = GetPrincipalContext())
            {
                var userName = principal.Identity.Name;

                // find the user in the identity store
                UserPrincipal user = UserPrincipal.FindByIdentity(context, userName);

                // email address
                string email = user.EmailAddress;
                if (!String.IsNullOrEmpty(email))
                {
                    claims.Add(new Claim(ClaimTypes.Email, email));
                }

                // roles
                GetRoles(userName, RoleTypes.Client).ToList().ForEach(role => claims.Add(new Claim(ClaimTypes.Role, role)));

                // profile claims
                if (ProfileManager.Enabled)
                {
                    var profile = ProfileBase.Create(userName, true);
                    if (profile != null)
                    {
                        foreach (SettingsProperty prop in ProfileBase.Properties)
                        {
                            string value = profile.GetPropertyValue(prop.Name).ToString();
                            if (!String.IsNullOrWhiteSpace(value))
                            {
                                claims.Add(new Claim(ProfileClaimPrefix + prop.Name.ToLowerInvariant(), value));
                            }
                        }
                    }
                }
            }

            return claims;
        }

        public RequestDetailsScope(RequestDetails details, SigningCredentials signingCredentials, bool requireEncryption)
            : base(details.Realm.Uri.AbsoluteUri, signingCredentials)
        {
            RequestDetails = details;

            if (RequestDetails.UsesEncryption)
            {
                EncryptingCredentials = new X509EncryptingCredentials(details.EncryptingCertificate);
            }

            if (RequestDetails.TokenType == TokenTypes.SimpleWebToken || RequestDetails.TokenType == TokenTypes.JsonWebToken)
            {
                if (details.RelyingPartyRegistration.SymmetricSigningKey != null && details.RelyingPartyRegistration.SymmetricSigningKey.Length > 0)
                {
                    SigningCredentials = new HmacSigningCredentials(details.RelyingPartyRegistration.SymmetricSigningKey);
                }
            }

            ReplyToAddress = RequestDetails.ReplyToAddress.AbsoluteUri;
            TokenEncryptionRequired = requireEncryption;
        }

        public override IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
        {
            if (requestDetails.Realm.Uri.AbsoluteUri == "http://sbserver/swttest/")
            {
                if (principal.Identity.Name == "bob")
                {
                    return new List<Claim>
                    {
                        new Claim(sbClaimType, "Listen"),
                        new Claim(sbClaimType, "Manage"),
                    };
                }
                else
                {
                    return new List<Claim>
                    {
                        new Claim(sbClaimType, "Send"),
                    };
                }
            }

            return base.GetClaims(principal, requestDetails);
        }

        public IEnumerable<Claim> ProcessClaims(ClaimsPrincipal incomingPrincipal, IdentityProvider identityProvider, RequestDetails details)
        {
            var audienceUri = details.Realm.Uri.AbsoluteUri;
            var newClaimsPrincipal = (ClaimsIdentity)incomingPrincipal.Identity;
            newClaimsPrincipal.AddClaim(new Claim("http://schemas.fcsamerica.com/claims/PartnerApps/audienceuri", audienceUri));
            return newClaimsPrincipal.Claims;

            /*  Prototype code to test loading Claims Mapper Claims from STS.

            ClaimsIdentity claimsIdentity = incomingPrincipal.Identity as ClaimsIdentity;
            var emailClaim = incomingPrincipal.Claims.FirstOrDefault(_ => _.Type.Equals(ClaimTypes.Email));
               // var partnerClaim = incomingPrincipal.Claims.FirstOrDefault(_ => _.Type.Con)
               // NOTE: McGruff has a Get Partner Name from Host Header Method.
               // QUESTION:  How will we store the STS generated SAML token on the claims principal?  It isn't rewritten yet. We will need to generate it here?
               // QUESTION:  If the Audit Info is on the claims principal... We would still need logic to help people determine which one to pull.  Look at RequestHeader first, then Claims Principal.
               // QUESTION:  We still need an API for accessing SAML token and AuditInfo.   Can this be the Token Generator?
               // QUESTION:  How much of the WIF settings can be added to the Website Root for Inheritance?
               // QUESTION:  How can we call Claims Mapper Service without a SAML token.  - it hasn't been created yet. Or can we create a temporary one here????
            List<Claim> claims = new List<Claim>();
            if( emailClaim != null)
            {
                var emailAddress = emailClaim.Value;
                var realm = details.Realm.ToString();
                var applicationName = realm.Substring(realm.IndexOf(":")+1);

                // call claims mapper and add additional claims...
                claims.Add(new Claim("AuditInfo", "Test AuditInfo Value"));
            }
            else
            {
                claims.Add(new Claim("STSClaimsLoadError", "Could not determine the partner and/or application. Make sure the realm has the application name and IdP provides the partner claim."));
            }

            claimsIdentity.AddClaims(claims);
            return claimsIdentity.Claims;
            */
        }

 public IEnumerable<Claim> ProcessClaims(ClaimsPrincipal incomingPrincipal, IdentityProvider identityProvider, RequestDetails details)
 {
     return incomingPrincipal.Claims;
 }

 protected virtual void AnalyzeTokenType(RequestSecurityToken rst, RequestDetails details)
 {
     if (string.IsNullOrWhiteSpace(rst.TokenType))
     {
         details.TokenType = _configuration.DefaultTokenType;
         Tracing.Information("Token Type: not specified, falling back to default token type");
     }
     else
     {
         Tracing.Information("Token Type: " + rst.TokenType);
         details.TokenType = rst.TokenType;
     }
 }

 protected virtual void AnalyzeDelegation(RequestSecurityToken rst, RequestDetails details)
 {
     // check for identity delegation request
     if (rst.ActAs != null)
     {
         details.IsActAsRequest = true;
         Tracing.Information("Request is ActAs request");
     }
 }

        public IEnumerable<Claim> GetClaims(ClaimsPrincipal principal, RequestDetails requestDetails)
        {
            var userName = principal.Identity.Name;
            var claims = new List<Claim>(from c in principal.Claims select c);

            // roles
            GetRolesForToken(userName).ToList().ForEach(role => claims.Add(new Claim(System.Security.Claims.ClaimTypes.Role, role)));

            // profile claims
            claims.AddRange(GetProfileClaims(userName));

            //context claims 
            if (requestDetails.Request.AdditionalContext != null && requestDetails.Request.AdditionalContext.Items.Count() > 0)
            {
                //Aggiunta di Claim da parte del client questa logica serve per settare di lingua,company e profilo

                var passedProfile = requestDetails.Request.AdditionalContext.Items.FirstOrDefault(p => p.Name.ToString() == Sagrada.IdentityServer.ClaimTypes.Profile);
                if (passedProfile != null)
                {
                    var profiles = SagradaIdentityService.GetProfiles(userName);
                    if (profiles.Count(p => p.Item1.ToString() == passedProfile.Value) == 0)
                    {
                        string errors = string.Format("additionalContext request from {0} has a not valid claim : {1}.", requestDetails.Realm.Uri, Sagrada.IdentityServer.ClaimTypes.Profile);
                        Tracing.Error(errors);
                        throw new InvalidRequestException(errors);
                    }
                    else
                        claims.Add(new Claim(Sagrada.IdentityServer.ClaimTypes.Profile, passedProfile.Value));
                }
                
                var passedCompany = requestDetails.Request.AdditionalContext.Items.FirstOrDefault(p => p.Name.ToString() == Sagrada.IdentityServer.ClaimTypes.Company);
                if (passedCompany != null)
                {
                    var companies = SagradaIdentityService.GetCompanies();
                    if (companies.Count(p => p.Item1.ToString() == passedCompany.Value) == 0)
                    {
                        string errors = string.Format("additionalContext request from {0} has a not valid claim : {1}.", requestDetails.Realm.Uri, Sagrada.IdentityServer.ClaimTypes.Company);
                        Tracing.Error(errors);
                        throw new InvalidRequestException(errors);
                    }
                    else
                        claims.Add(new Claim(Sagrada.IdentityServer.ClaimTypes.Company, passedCompany.Value));
                }
            
                var passedLanguage = requestDetails.Request.AdditionalContext.Items.FirstOrDefault(p => p.Name.ToString() == Sagrada.IdentityServer.ClaimTypes.Language);
                if (passedLanguage != null)
                {
                    var languages = SagradaIdentityService.GetLanguages();
                    if (languages.Count(p => p.Name == passedLanguage.Value) == 0)
                    {
                        string errors = string.Format("additionalContext request from {0} has a not valid claim : {1}.", requestDetails.Realm.Uri, Sagrada.IdentityServer.ClaimTypes.Language);
                        Tracing.Error(errors);
                        throw new InvalidRequestException(errors);
                    }
                    else
                        claims.Add(new Claim(Sagrada.IdentityServer.ClaimTypes.Language, passedLanguage.Value));
                }
            
            };

            return claims;
        }

 protected virtual void ValidateEncryption(RequestDetails details)
 {
     // check if token must be encrypted
     if (_configuration.RequireEncryption && (!details.UsesEncryption))
     {
         Tracing.Error("Configuration requires encryption - but no key available");
         throw new InvalidRequestException("No encryption key available");
     }
 }

 protected virtual void ValidateSsl(RequestDetails details)
 {
     // check if SSL is used (for passive only)
     if (_configuration.RequireSsl && !details.UsesSsl)
     {
         if (!details.IsActive)
         {
             Tracing.Error("Configuration requires SSL - but clear text reply address used");
             throw new InvalidRequestException("SSL is required");
         }
     }
 }