title: ASP.NET Core 2.0 Bearer Auth without Identity
body: <p>I thought I had a pretty simple goal in mind when I set out a day ago to implement a self-contained bearer auth webapi on .NET core 2.0, but I have yet to get anything remotely working.  Here's a list of what I'm trying to do:</p>
  
  <ul>
  <li>Implement a bearer token protected webapi</li>
  <li>Issue tokens &amp; refresh tokens from an endpoint in the same project</li>
  <li>Use the [Authorize] attribute to control access to api surface</li>
  <li>Not use ASP.Net Identity (I have much lighter weight user/membership reqs)</li>
  </ul>
  
  <p>I'm totally fine with building identity/claims/principal in login and adding that to request context, but I've not seen a single example on how to issue and consume auth/refresh tokens in a Core 2.0 webapi without Identity.  I've seen the 1.x MSDN example of cookies without Identity, but that didn't get me far enough in understanding to meet the requirements above.  </p>
  
  <p>I feel like this might be a common scenario and it shouldn't be this hard (maybe it's not, maybe just lack of documentation/examples?).  As far as I can tell, IdentityServer4 is not compatible with Core 2.0 Auth, opendiddict seems to require Identity. I also don't want to host the token endpoint in a separate process, but within the same webapi instance.</p>
  
  <p>Can anyone point me to a concrete example, or at least give some guidance as to what best steps/options are?  </p>