Move to HttpClient throughout library.

12 files changed, 143 insertions, 85 deletions

diff --git a/samples/OAuthServiceProvider/Code/Constants.cs b/samples/OAuthServiceProvider/Code/Constants.cs
index 3e629f0..9115f1c 100644
--- a/samples/OAuthServiceProvider/Code/Constants.cs
+++ b/samples/OAuthServiceProvider/Code/Constants.cs
@@ -10,9 +10,9 @@
 	public static class Constants {
 		public static Uri WebRootUrl { get; set; }
 
-		public static ServiceProviderDescription SelfDescription {
+		public static ServiceProviderHostDescription SelfDescription {
 			get {
-				ServiceProviderDescription description = new ServiceProviderDescription {
+				var description = new ServiceProviderHostDescription {
 					AccessTokenEndpoint = new MessageReceivingEndpoint(new Uri(WebRootUrl, "/OAuth.ashx"), HttpDeliveryMethods.PostRequest),
 					RequestTokenEndpoint = new MessageReceivingEndpoint(new Uri(WebRootUrl, "/OAuth.ashx"), HttpDeliveryMethods.PostRequest),
 					UserAuthorizationEndpoint = new MessageReceivingEndpoint(new Uri(WebRootUrl, "/OAuth.ashx"), HttpDeliveryMethods.PostRequest),
diff --git a/samples/OAuthServiceProvider/Code/DatabaseTokenManager.cs b/samples/OAuthServiceProvider/Code/DatabaseTokenManager.cs
index 49da45d..7c80275 100644
--- a/samples/OAuthServiceProvider/Code/DatabaseTokenManager.cs
+++ b/samples/OAuthServiceProvider/Code/DatabaseTokenManager.cs
@@ -9,13 +9,18 @@ namespace OAuthServiceProvider.Code {
 	using System.Collections.Generic;
 	using System.Diagnostics;
 	using System.Linq;
+	using System.ServiceModel;
+
 	using DotNetOpenAuth.OAuth.ChannelElements;
 	using DotNetOpenAuth.OAuth.Messages;
 
 	public class DatabaseTokenManager : IServiceProviderTokenManager {
+		internal OperationContext OperationContext { get; set; }
+
 		#region IServiceProviderTokenManager
 
 		public IConsumerDescription GetConsumer(string consumerKey) {
+			this.ApplyOperationContext();
 			var consumerRow = Global.DataContext.OAuthConsumers.SingleOrDefault(
 				consumerCandidate => consumerCandidate.ConsumerKey == consumerKey);
 			if (consumerRow == null) {
@@ -27,6 +32,7 @@ namespace OAuthServiceProvider.Code {
 
 		public IServiceProviderRequestToken GetRequestToken(string token) {
 			try {
+				this.ApplyOperationContext();
 				return Global.DataContext.OAuthTokens.First(t => t.Token == token && t.State != TokenAuthorizationState.AccessToken);
 			} catch (InvalidOperationException ex) {
 				throw new KeyNotFoundException("Unrecognized token", ex);
@@ -34,6 +40,7 @@ namespace OAuthServiceProvider.Code {
 		}
 
 		public IServiceProviderAccessToken GetAccessToken(string token) {
+			this.ApplyOperationContext();
 			try {
 				return Global.DataContext.OAuthTokens.First(t => t.Token == token && t.State == TokenAuthorizationState.AccessToken);
 			} catch (InvalidOperationException ex) {
@@ -54,6 +61,7 @@ namespace OAuthServiceProvider.Code {
 		#region ITokenManager Members
 
 		public string GetTokenSecret(string token) {
+			this.ApplyOperationContext();
 			var tokenRow = Global.DataContext.OAuthTokens.SingleOrDefault(
 				tokenCandidate => tokenCandidate.Token == token);
 			if (tokenRow == null) {
@@ -64,6 +72,7 @@ namespace OAuthServiceProvider.Code {
 		}
 
 		public void StoreNewRequestToken(UnauthorizedTokenRequest request, ITokenSecretContainingMessage response) {
+			this.ApplyOperationContext();
 			RequestScopedTokenMessage scopedRequest = (RequestScopedTokenMessage)request;
 			var consumer = Global.DataContext.OAuthConsumers.Single(consumerRow => consumerRow.ConsumerKey == request.ConsumerKey);
 			string scope = scopedRequest.Scope;
@@ -90,6 +99,7 @@ namespace OAuthServiceProvider.Code {
 		/// been authorized, has expired or does not exist.
 		/// </returns>
 		public bool IsRequestTokenAuthorized(string requestToken) {
+			this.ApplyOperationContext();
 			var tokenFound = Global.DataContext.OAuthTokens.SingleOrDefault(
 				token => token.Token == requestToken &&
 				token.State == TokenAuthorizationState.AuthorizedRequestToken);
@@ -97,6 +107,8 @@ namespace OAuthServiceProvider.Code {
 		}
 
 		public void ExpireRequestTokenAndStoreNewAccessToken(string consumerKey, string requestToken, string accessToken, string accessTokenSecret) {
+			this.ApplyOperationContext();
+
 			var data = Global.DataContext;
 			var consumerRow = data.OAuthConsumers.Single(consumer => consumer.ConsumerKey == consumerKey);
 			var tokenRow = data.OAuthTokens.Single(token => token.Token == requestToken && token.OAuthConsumer == consumerRow);
@@ -115,6 +127,7 @@ namespace OAuthServiceProvider.Code {
 		/// <param name="token">The token to classify.</param>
 		/// <returns>Request or Access token, or invalid if the token is not recognized.</returns>
 		public TokenType GetTokenType(string token) {
+			this.ApplyOperationContext();
 			var tokenRow = Global.DataContext.OAuthTokens.SingleOrDefault(tokenCandidate => tokenCandidate.Token == token);
 			if (tokenRow == null) {
 				return TokenType.InvalidToken;
@@ -135,6 +148,7 @@ namespace OAuthServiceProvider.Code {
 				throw new ArgumentNullException("user");
 			}
 
+			this.ApplyOperationContext();
 			var tokenRow = Global.DataContext.OAuthTokens.SingleOrDefault(
 				tokenCandidate => tokenCandidate.Token == requestToken &&
 				tokenCandidate.State == TokenAuthorizationState.UnauthorizedRequestToken);
@@ -151,6 +165,7 @@ namespace OAuthServiceProvider.Code {
 				throw new ArgumentNullException("requestToken");
 			}
 
+			this.ApplyOperationContext();
 			var tokenRow = Global.DataContext.OAuthTokens.SingleOrDefault(
 				tokenCandidate => tokenCandidate.Token == token);
 			if (tokenRow == null) {
@@ -159,5 +174,11 @@ namespace OAuthServiceProvider.Code {
 
 			return tokenRow.OAuthConsumer;
 		}
+
+		private void ApplyOperationContext() {
+			if (this.OperationContext != null && OperationContext.Current == null) {
+				OperationContext.Current = this.OperationContext;
+			}
+		}
 	}
 }
\ No newline at end of file
diff --git a/samples/OAuthServiceProvider/Code/Global.cs b/samples/OAuthServiceProvider/Code/Global.cs
index 60fed9f..37206ab 100644
--- a/samples/OAuthServiceProvider/Code/Global.cs
+++ b/samples/OAuthServiceProvider/Code/Global.cs
@@ -10,6 +10,10 @@
 	/// The web application global events and properties.
 	/// </summary>
 	public class Global : HttpApplication {
+		private readonly object syncObject = new object();
+
+		private volatile bool initialized;
+
 		/// <summary>
 		/// An application memory cache of recent log messages.
 		/// </summary>
@@ -95,17 +99,6 @@
 		private void Application_Start(object sender, EventArgs e) {
 			log4net.Config.XmlConfigurator.Configure();
 			Logger.Info("Sample starting...");
-			string appPath = HttpContext.Current.Request.ApplicationPath;
-			if (!appPath.EndsWith("/")) {
-				appPath += "/";
-			}
-
-			// This will break in IIS Integrated Pipeline mode, since applications
-			// start before the first incoming request context is available.
-			// TODO: fix this.
-			Constants.WebRootUrl = new Uri(HttpContext.Current.Request.Url, appPath);
-			Global.TokenManager = new DatabaseTokenManager();
-			Global.NonceStore = new DatabaseNonceStore();
 		}
 
 		private void Application_End(object sender, EventArgs e) {
@@ -128,8 +121,30 @@
 			}
 		}
 
+		private void Application_BeginRequest(object sender, EventArgs e) {
+			this.EnsureInitialized();
+		}
+
 		private void Application_EndRequest(object sender, EventArgs e) {
 			CommitAndCloseDatabaseIfNecessary();
 		}
+
+		private void EnsureInitialized() {
+			if (!this.initialized) {
+				lock (this.syncObject) {
+					if (!this.initialized) {
+						string appPath = HttpContext.Current.Request.ApplicationPath;
+						if (!appPath.EndsWith("/")) {
+							appPath += "/";
+						}
+
+						Constants.WebRootUrl = new Uri(HttpContext.Current.Request.Url, appPath);
+						Global.TokenManager = new DatabaseTokenManager();
+						Global.NonceStore = new DatabaseNonceStore();
+						this.initialized = true;
+					}
+				}
+			}
+		}
 	}
 }
\ No newline at end of file
diff --git a/samples/OAuthServiceProvider/Code/OAuthAuthorizationManager.cs b/samples/OAuthServiceProvider/Code/OAuthAuthorizationManager.cs
index 917a252..2d942b5 100644
--- a/samples/OAuthServiceProvider/Code/OAuthAuthorizationManager.cs
+++ b/samples/OAuthServiceProvider/Code/OAuthAuthorizationManager.cs
@@ -7,6 +7,7 @@
 	using System.ServiceModel;
 	using System.ServiceModel.Channels;
 	using System.ServiceModel.Security;
+	using System.Threading.Tasks;
 	using DotNetOpenAuth;
 	using DotNetOpenAuth.OAuth;
 
@@ -25,41 +26,41 @@
 			HttpRequestMessageProperty httpDetails = operationContext.RequestContext.RequestMessage.Properties[HttpRequestMessageProperty.Name] as HttpRequestMessageProperty;
 			Uri requestUri = operationContext.RequestContext.RequestMessage.Properties.Via;
 			ServiceProvider sp = Constants.CreateServiceProvider();
-			try {
-				var auth = sp.ReadProtectedResourceAuthorization(httpDetails, requestUri);
-				if (auth != null) {
-					var accessToken = Global.DataContext.OAuthTokens.Single(token => token.Token == auth.AccessToken);
+			((DatabaseTokenManager)sp.TokenManager).OperationContext = operationContext; // artificially preserve this across thread changes.
+			return Task.Run(
+				async delegate {
+					try {
+						var auth = await sp.ReadProtectedResourceAuthorizationAsync(httpDetails, requestUri);
+						if (auth != null) {
+							var accessToken = Global.DataContext.OAuthTokens.Single(token => token.Token == auth.AccessToken);
 
-					var principal = sp.CreatePrincipal(auth);
-					var policy = new OAuthPrincipalAuthorizationPolicy(principal);
-					var policies = new List<IAuthorizationPolicy> {
-					policy,
-				};
+							var principal = sp.CreatePrincipal(auth);
+							var policy = new OAuthPrincipalAuthorizationPolicy(principal);
+							var policies = new List<IAuthorizationPolicy> { policy, };
 
-					var securityContext = new ServiceSecurityContext(policies.AsReadOnly());
-					if (operationContext.IncomingMessageProperties.Security != null) {
-						operationContext.IncomingMessageProperties.Security.ServiceSecurityContext = securityContext;
-					} else {
-						operationContext.IncomingMessageProperties.Security = new SecurityMessageProperty {
-							ServiceSecurityContext = securityContext,
-						};
-					}
+							var securityContext = new ServiceSecurityContext(policies.AsReadOnly());
+							if (operationContext.IncomingMessageProperties.Security != null) {
+								operationContext.IncomingMessageProperties.Security.ServiceSecurityContext = securityContext;
+							} else {
+								operationContext.IncomingMessageProperties.Security = new SecurityMessageProperty {
+									ServiceSecurityContext = securityContext,
+								};
+							}
 
-					securityContext.AuthorizationContext.Properties["Identities"] = new List<IIdentity> {
-					principal.Identity,
-				};
+							securityContext.AuthorizationContext.Properties["Identities"] = new List<IIdentity> { principal.Identity, };
 
-					// Only allow this method call if the access token scope permits it.
-					string[] scopes = accessToken.Scope.Split('|');
-					if (scopes.Contains(operationContext.IncomingMessageHeaders.Action)) {
-						return true;
+							// Only allow this method call if the access token scope permits it.
+							string[] scopes = accessToken.Scope.Split('|');
+							if (scopes.Contains(operationContext.IncomingMessageHeaders.Action)) {
+								return true;
+							}
+						}
+					} catch (ProtocolException ex) {
+						Global.Logger.Error("Error processing OAuth messages.", ex);
 					}
-				}
-			} catch (ProtocolException ex) {
-				Global.Logger.Error("Error processing OAuth messages.", ex);
-			}
 
-			return false;
+					return false;
+				}).GetAwaiter().GetResult();
 		}
 	}
 }
\ No newline at end of file
diff --git a/samples/OAuthServiceProvider/Code/OAuthPrincipalAuthorizationPolicy.cs b/samples/OAuthServiceProvider/Code/OAuthPrincipalAuthorizationPolicy.cs
index a25f4c5..4ce60bb 100644
--- a/samples/OAuthServiceProvider/Code/OAuthPrincipalAuthorizationPolicy.cs
+++ b/samples/OAuthServiceProvider/Code/OAuthPrincipalAuthorizationPolicy.cs
@@ -4,18 +4,19 @@
 	using System.IdentityModel.Claims;
 	using System.IdentityModel.Policy;
 	using System.Linq;
+	using System.Security.Principal;
 	using System.Web;
 	using DotNetOpenAuth.OAuth.ChannelElements;
 
 	public class OAuthPrincipalAuthorizationPolicy : IAuthorizationPolicy {
 		private readonly Guid uniqueId = Guid.NewGuid();
-		private readonly OAuthPrincipal principal;
+		private readonly IPrincipal principal;
 
 		/// <summary>
 		/// Initializes a new instance of the <see cref="OAuthPrincipalAuthorizationPolicy"/> class.
 		/// </summary>
 		/// <param name="principal">The principal.</param>
-		public OAuthPrincipalAuthorizationPolicy(OAuthPrincipal principal) {
+		public OAuthPrincipalAuthorizationPolicy(IPrincipal principal) {
 			this.principal = principal;
 		}
 
diff --git a/samples/OAuthServiceProvider/Login.aspx b/samples/OAuthServiceProvider/Login.aspx
index 4498ee0..0b84ab9 100644
--- a/samples/OAuthServiceProvider/Login.aspx
+++ b/samples/OAuthServiceProvider/Login.aspx
@@ -1,4 +1,4 @@
-<%@ Page Title="Login" Language="C#" MasterPageFile="~/MasterPage.master" %>
+<%@ Page Title="Login" Language="C#" MasterPageFile="~/MasterPage.master" Async="true" %>
 
 <%@ Register Assembly="DotNetOpenAuth.OpenId.RelyingParty.UI" Namespace="DotNetOpenAuth.OpenId.RelyingParty" TagPrefix="rp" %>
 
diff --git a/samples/OAuthServiceProvider/Members/Authorize.aspx b/samples/OAuthServiceProvider/Members/Authorize.aspx
index b3e2c6a..e7be651 100644
--- a/samples/OAuthServiceProvider/Members/Authorize.aspx
+++ b/samples/OAuthServiceProvider/Members/Authorize.aspx
@@ -1,4 +1,4 @@
-<%@ Page Title="" Language="C#" MasterPageFile="~/MasterPage.master" AutoEventWireup="true" Inherits="OAuthServiceProvider.Authorize" Codebehind="Authorize.aspx.cs" %>
+<%@ Page Title="" Language="C#" MasterPageFile="~/MasterPage.master" AutoEventWireup="true" Inherits="OAuthServiceProvider.Authorize" Codebehind="Authorize.aspx.cs" Async="true" %>
 
 <asp:Content ID="Content2" ContentPlaceHolderID="Body" runat="Server">
 	<asp:MultiView runat="server" ActiveViewIndex="0" ID="multiView">
diff --git a/samples/OAuthServiceProvider/Members/Authorize.aspx.cs b/samples/OAuthServiceProvider/Members/Authorize.aspx.cs
index faa2147..073231b 100644
--- a/samples/OAuthServiceProvider/Members/Authorize.aspx.cs
+++ b/samples/OAuthServiceProvider/Members/Authorize.aspx.cs
@@ -7,6 +7,7 @@
 	using System.Web.UI;
 	using System.Web.UI.WebControls;
 	using DotNetOpenAuth;
+	using DotNetOpenAuth.Messaging;
 	using DotNetOpenAuth.OAuth;
 	using DotNetOpenAuth.OAuth.Messages;
 	using OAuthServiceProvider.Code;
@@ -46,30 +47,36 @@
 		}
 
 		protected void allowAccessButton_Click(object sender, EventArgs e) {
-			if (this.AuthorizationSecret != this.OAuthAuthorizationSecToken.Value) {
-				throw new ArgumentException(); // probably someone trying to hack in.
-			}
-			this.AuthorizationSecret = null; // clear one time use secret
-			var pending = Global.PendingOAuthAuthorization;
-			Global.AuthorizePendingRequestToken();
-			this.multiView.ActiveViewIndex = 1;
+			this.RegisterAsyncTask(
+				new PageAsyncTask(
+					async ct => {
+						if (this.AuthorizationSecret != this.OAuthAuthorizationSecToken.Value) {
+							throw new ArgumentException(); // probably someone trying to hack in.
+						}
+						this.AuthorizationSecret = null; // clear one time use secret
+						var pending = Global.PendingOAuthAuthorization;
+						Global.AuthorizePendingRequestToken();
+						this.multiView.ActiveViewIndex = 1;
 
-			ServiceProvider sp = new ServiceProvider(Constants.SelfDescription, Global.TokenManager);
-			var response = sp.PrepareAuthorizationResponse(pending);
-			if (response != null) {
-				sp.Channel.Send(response);
-			} else {
-				if (pending.IsUnsafeRequest) {
-					this.verifierMultiView.ActiveViewIndex = 1;
-				} else {
-					string verifier = ServiceProvider.CreateVerificationCode(VerificationCodeFormat.AlphaNumericNoLookAlikes, 10);
-					this.verificationCodeLabel.Text = verifier;
-					ITokenContainingMessage requestTokenMessage = pending;
-					var requestToken = Global.TokenManager.GetRequestToken(requestTokenMessage.Token);
-					requestToken.VerificationCode = verifier;
-					Global.TokenManager.UpdateToken(requestToken);
-				}
-			}
+						ServiceProvider sp = new ServiceProvider(Constants.SelfDescription, Global.TokenManager);
+						var response = sp.PrepareAuthorizationResponse(pending);
+						if (response != null) {
+							var responseMessage = await sp.Channel.PrepareResponseAsync(response, Response.ClientDisconnectedToken);
+							await responseMessage.SendAsync();
+							this.Context.Response.End();
+						} else {
+							if (pending.IsUnsafeRequest) {
+								this.verifierMultiView.ActiveViewIndex = 1;
+							} else {
+								string verifier = ServiceProvider.CreateVerificationCode(VerificationCodeFormat.AlphaNumericNoLookAlikes, 10);
+								this.verificationCodeLabel.Text = verifier;
+								ITokenContainingMessage requestTokenMessage = pending;
+								var requestToken = Global.TokenManager.GetRequestToken(requestTokenMessage.Token);
+								requestToken.VerificationCode = verifier;
+								Global.TokenManager.UpdateToken(requestToken);
+							}
+						}
+					}));
 		}
 
 		protected void denyAccessButton_Click(object sender, EventArgs e) {
diff --git a/samples/OAuthServiceProvider/OAuth.ashx b/samples/OAuthServiceProvider/OAuth.ashx
index 8a74926..003735c 100644
--- a/samples/OAuthServiceProvider/OAuth.ashx
+++ b/samples/OAuthServiceProvider/OAuth.ashx
@@ -2,41 +2,45 @@
 
 using System;
 using System.Linq;
+using System.Threading.Tasks;
 using System.Web;
 using System.Web.SessionState;
+using DotNetOpenAuth.ApplicationBlock;
 using DotNetOpenAuth.OAuth;
 using DotNetOpenAuth.OAuth.ChannelElements;
 using DotNetOpenAuth.OAuth.Messages;
 using DotNetOpenAuth.Messaging;
 using OAuthServiceProvider.Code;
 
-public class OAuth : IHttpHandler, IRequiresSessionState {
+public class OAuth : HttpAsyncHandlerBase, IRequiresSessionState {
 	ServiceProvider sp;
 
 	public OAuth() {
 		sp = new ServiceProvider(Constants.SelfDescription, Global.TokenManager, new CustomOAuthMessageFactory(Global.TokenManager));
 	}
 
-	public void ProcessRequest(HttpContext context) {
-		IProtocolMessage request = sp.ReadRequest();
+	public override bool IsReusable {
+		get { return true; }
+	}
+
+	protected override async Task ProcessRequestAsync(HttpContext context) {
+		IProtocolMessage request = await sp.ReadRequestAsync();
 		RequestScopedTokenMessage requestToken;
 		UserAuthorizationRequest requestAuth;
 		AuthorizedTokenRequest requestAccessToken;
 		if ((requestToken = request as RequestScopedTokenMessage) != null) {
 			var response = sp.PrepareUnauthorizedTokenMessage(requestToken);
-			sp.Channel.Send(response);
+			var responseMessage = await sp.Channel.PrepareResponseAsync(response);
+			await responseMessage.SendAsync(new HttpContextWrapper(context));
 		} else if ((requestAuth = request as UserAuthorizationRequest) != null) {
 			Global.PendingOAuthAuthorization = requestAuth;
 			HttpContext.Current.Response.Redirect("~/Members/Authorize.aspx");
 		} else if ((requestAccessToken = request as AuthorizedTokenRequest) != null) {
 			var response = sp.PrepareAccessTokenMessage(requestAccessToken);
-			sp.Channel.Send(response);
+			var responseMessage = await sp.Channel.PrepareResponseAsync(response);
+			await responseMessage.SendAsync(new HttpContextWrapper(context));
 		} else {
 			throw new InvalidOperationException();
 		}
 	}
-
-	public bool IsReusable {
-		get { return true; }
-	}
 }
diff --git a/samples/OAuthServiceProvider/OAuthServiceProvider.csproj b/samples/OAuthServiceProvider/OAuthServiceProvider.csproj
index 5419347..65d5a1f 100644
--- a/samples/OAuthServiceProvider/OAuthServiceProvider.csproj
+++ b/samples/OAuthServiceProvider/OAuthServiceProvider.csproj
@@ -26,7 +26,7 @@
     <RootNamespace>OAuthServiceProvider</RootNamespace>
     <AssemblyName>OAuthServiceProvider</AssemblyName>
     <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
-    <UseIISExpress>false</UseIISExpress>
+    <UseIISExpress>true</UseIISExpress>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <DebugSymbols>true</DebugSymbols>
@@ -54,6 +54,8 @@
     <Reference Include="System.Data.DataSetExtensions" />
     <Reference Include="System.Data.Linq" />
     <Reference Include="System.IdentityModel" />
+    <Reference Include="System.Net.Http" />
+    <Reference Include="System.Net.Http.WebRequest" />
     <Reference Include="System.ServiceModel" />
     <Reference Include="System.Web.ApplicationServices" />
     <Reference Include="System.Web.DynamicData" />
@@ -188,6 +190,10 @@
       <Project>{3896A32A-E876-4C23-B9B8-78E17D134CD3}</Project>
       <Name>DotNetOpenAuth.OpenId</Name>
     </ProjectReference>
+    <ProjectReference Include="..\DotNetOpenAuth.ApplicationBlock\DotNetOpenAuth.ApplicationBlock.csproj">
+      <Project>{aa78d112-d889-414b-a7d4-467b34c7b663}</Project>
+      <Name>DotNetOpenAuth.ApplicationBlock</Name>
+    </ProjectReference>
   </ItemGroup>
   <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
   <Import Project="$(VSToolsPath)\WebApplications\Microsoft.WebApplication.targets" Condition="'$(VSToolsPath)' != ''" />
@@ -196,12 +202,11 @@
     <VisualStudio>
       <FlavorProperties GUID="{349c5851-65df-11da-9384-00065b846f21}">
         <WebProjectProperties>
-          <UseIIS>False</UseIIS>
+          <UseIIS>True</UseIIS>
           <AutoAssignPort>False</AutoAssignPort>
           <DevelopmentServerPort>65169</DevelopmentServerPort>
           <DevelopmentServerVPath>/</DevelopmentServerVPath>
-          <IISUrl>
-          </IISUrl>
+          <IISUrl>http://localhost:65169/</IISUrl>
           <NTLMAuthentication>False</NTLMAuthentication>
           <UseCustomServer>False</UseCustomServer>
           <CustomServerUrl>
diff --git a/samples/OAuthServiceProvider/Web.config b/samples/OAuthServiceProvider/Web.config
index 21fe388..84aea1e 100644
--- a/samples/OAuthServiceProvider/Web.config
+++ b/samples/OAuthServiceProvider/Web.config
@@ -40,13 +40,16 @@
 		</messaging>
 	</dotNetOpenAuth>
 
-	<appSettings/>
+	<appSettings>
+		<add key="ValidationSettings:UnobtrusiveValidationMode" value="None" />
+	</appSettings>
 	<connectionStrings>
   <add name="DatabaseConnectionString" connectionString="Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\Database.mdf;Integrated Security=True;User Instance=True"
    providerName="System.Data.SqlClient" />
  </connectionStrings>
 
 	<system.web>
+		<httpRuntime targetFramework="4.5" />
 		<!-- 
             Set compilation debug="true" to insert debugging 
             symbols into the compiled page. Because this 
@@ -55,8 +58,8 @@
         -->
 		<compilation debug="true" targetFramework="4.0">
 			<assemblies>
-				<remove assembly="DotNetOpenAuth.Contracts"/>
-				<add assembly="System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089"/>
+				<add assembly="System.Data.Linq, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
+				<add assembly="System.Net.Http, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
 			</assemblies>
 		</compilation>
 		<authentication mode="Forms">
diff --git a/samples/OAuthServiceProvider/packages.config b/samples/OAuthServiceProvider/packages.config
index 6562527..8e40260 100644
--- a/samples/OAuthServiceProvider/packages.config
+++ b/samples/OAuthServiceProvider/packages.config
@@ -1,4 +1,5 @@
 <?xml version="1.0" encoding="utf-8"?>
 <packages>
   <package id="log4net" version="2.0.0" targetFramework="net45" />
+  <package id="Microsoft.Net.Http" version="2.0.20710.0" targetFramework="net45" />
 </packages>
\ No newline at end of file