public void ConfigureServices(IServiceCollection services) {
    services.AddMvc();

    services.AddDbContext<ApplicationDbContext>(options =>
        options.UseSqlServer(Configuration["Data:DefaultConnection:ConnectionString"]));       

    // Register the Identity services.
	services.AddIdentity<ApplicationUser, IdentityRole>()
	    .AddEntityFrameworkStores<ApplicationDbContext>()
	    .AddDefaultTokenProviders();

	// Register the OpenIddict services, including the default Entity Framework stores.
	services.AddOpenIddict<ApplicationUser, ApplicationDbContext>()
        // Enable the token endpoint (required to use the password flow).
        .EnableTokenEndpoint("/connect/token")

        // Allow client applications to use the grant_type=password flow.
        .AllowPasswordFlow()

	    // During development, you can disable the HTTPS requirement.
	    .DisableHttpsRequirement()

        // Register a new ephemeral key, that is discarded when the application
        // shuts down. Tokens signed using this key are automatically invalidated.
        // This method should only be used during development.
        .AddEphemeralSigningKey();
}

public void Configure(IApplicationBuilder app) {
    app.UseIdentity();

    app.UseOAuthValidation();

    app.UseOpenIddict();

    app.UseMvc();
}

public class ApplicationUser : OpenIddictUser { }

public class ApplicationDbContext : OpenIddictDbContext<ApplicationUser> {
    public ApplicationDbContext(DbContextOptions options)
        : base(options) {
    }
}

services.AddOpenIddict<ApplicationUser, IdentityRole<int>, ApplicationDbContext, int>()

public void ConfigureServices(IServiceCollection services) {
	// Register the OpenIddict services, including the default Entity Framework stores.
	services.AddOpenIddict<ApplicationUser, ApplicationDbContext>()
        // Enable the authorization and token endpoints (required to use the code flow).
        .EnableAuthorizationEndpoint("/connect/authorize")
        .EnableTokenEndpoint("/connect/token")

        // Allow client applications to use the code flow.
        .AllowAuthorizationCodeFlow()

	    // During development, you can disable the HTTPS requirement.
	    .DisableHttpsRequirement()

        // Register a new ephemeral key, that is discarded when the application
        // shuts down. Tokens signed using this key are automatically invalidated.
        // This method should only be used during development.
        .AddEphemeralSigningKey();
}

using (var context = new ApplicationDbContext(
    app.ApplicationServices.GetRequiredService<DbContextOptions<ApplicationDbContext>>())) {
    context.Database.EnsureCreated();

    if (!context.Applications.Any()) {
        context.Applications.Add(new OpenIddictApplication {
            // Assign a unique identifier to your client app:
            Id = "48BF1BC3-CE01-4787-BBF2-0426EAD21342",

            // Assign a display named used in the consent form page:
            DisplayName = "MVC Core client application",

            // Register the appropriate redirect_uri and post_logout_redirect_uri:
            RedirectUri = "http://localhost:53507/signin-oidc",
            LogoutRedirectUri = "http://localhost:53507/",

            // Generate a new derived key from the client secret:
            Secret = Crypto.HashPassword("secret_secret_secret"),

            // Note: use "public" for JS/mobile/desktop applications
            // and "confidential" for server-side applications.
            Type = OpenIddictConstants.ClientTypes.Confidential
        });

        context.SaveChanges();
    }
}