public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }

        /// <summary>

        /// 构造函数

        /// </summary>

        static Startup()

        {

            OAuthBearerOptions = new OAuthBearerAuthenticationOptions();

        }

            // 使用不记名身份验证

            app.UseOAuthBearerAuthentication(OAuthBearerOptions);

            config.SuppressDefaultHostAuthentication();

            config.Filters.Add(new HostAuthenticationFilter("Bearer"));

        [HttpPost]

        public async Task<String> Authenticate(string userName, string password)

        {

            if (string.IsNullOrEmpty(userAccount) || string.IsNullOrEmpty(password))

            {

                return string.Empty;

            }

            // 用户查找失败

            User user = await UserManager.FindAsync(userName, password);

            if (user == null)

            {

                return string.Empty;

            }

            // 身份验证票证包括角色或者可以换成用户名

            var identity = new ClaimsIdentity(Startup.OAuthBearerOptions.AuthenticationType);

            identity.AddClaim(new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()));

            if (UserManager.SupportsUserRole)

            {

                IList<string> roles = await UserManager.GetRolesAsync(user.Id).ConfigureAwait(false);

                foreach (string roleName in roles)

                {

                    identity.AddClaim(new Claim(ClaimTypes.Role, roleName, ClaimValueTypes.String));

                }

            }

            AuthenticationTicket ticket = new AuthenticationTicket(identity, new AuthenticationProperties());

            var currentUtc = DateTime.UtcNow;

            ticket.Properties.IssuedUtc = currentUtc;

            ticket.Properties.ExpiresUtc = currentUtc.Add(TimeSpan.FromDays(1));

            // 返回值

            return Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);

        }

[Authorize(Roles = "Admin")]

public class UsersController : ApiController

{

}