OAuthBearerAuthenticationHandler does not call SecurityTokenValidated

[mdekrey]

It looks like OAuthBearerAuthenticationHandler doesn't call the SecurityTokenValidated handler in the Options.Notifications.

In addition, logic goes on to use securityTokenReceivedNotification - securityTokenValidatedNotification is not checked after being instantiated, but is used once, hiding it from any Treat Warnings as Errors flags.

Starting with line 133:

var securityTokenValidatedNotification = new SecurityTokenValidatedNotification<HttpContext, OAuthBearerAuthenticationOptions>(Context, Options)
{
    ProtocolMessage = Context,
    AuthenticationTicket = ticket
};

// The following line is missing from source
await Options.Notifications.SecurityTokenValidated(securityTokenValidatedNotification);
if (securityTokenReceivedNotification.HandledResponse)
{
    return securityTokenValidatedNotification.AuthenticationTicket;
}

[kevinchalet]

Duplicate of #140

I already submitted a PR to fix it: #168

/cc @brentschmaltz @HaoK @Praburaj @Tratcher

[mdekrey]

@PinpointTownes Somehow didn't find your issue when searching for it. Thanks for pointing it out!