From ae98d4b84230ff922f2d65acd3d9d1759dc1f259 Mon Sep 17 00:00:00 2001
From: vibronet <vibro@libero.it>
Date: Wed, 22 Oct 2014 00:05:42 -0700
Subject: [PATCH] First commit

---
 TodoSPA.sln                               |   22 +
 TodoSPA/App/Scripts/App.js                |   28 +
 TodoSPA/App/Scripts/HomeController.js     |   11 +
 TodoSPA/App/Scripts/IndexController.js    |    3 +
 TodoSPA/App/Scripts/TodoListController.js |   74 ++
 TodoSPA/App/Scripts/TodoListService.js    |   36 +
 TodoSPA/App/Scripts/UserDataController.js |    4 +
 TodoSPA/App/Scripts/adal.js               | 1277 +++++++++++++++++++++
 TodoSPA/App/Views/Home.html               |    3 +
 TodoSPA/App/Views/TodoList.html           |   27 +
 TodoSPA/App/Views/UserData.html           |   23 +
 TodoSPA/App_Start/Startup.Auth.cs         |   24 +
 TodoSPA/App_Start/WebApiConfig.cs         |   24 +
 TodoSPA/Controllers/TodoListController.cs |  131 +++
 TodoSPA/DAL/TodoListServiceContext.cs     |   22 +
 TodoSPA/DAL/TodoListServiceInitializer.cs |   11 +
 TodoSPA/Global.asax                       |    1 +
 TodoSPA/Global.asax.cs                    |   20 +
 TodoSPA/Models/AppModels.cs               |   12 +
 TodoSPA/Properties/AssemblyInfo.cs        |   35 +
 TodoSPA/Startup.cs                        |   17 +
 TodoSPA/TodoSPA.csproj                    |  178 +++
 TodoSPA/Web.Debug.config                  |   30 +
 TodoSPA/Web.Release.config                |   31 +
 TodoSPA/Web.config                        |   66 ++
 TodoSPA/index.html                        |   67 ++
 TodoSPA/packages.config                   |   17 +
 27 files changed, 2194 insertions(+)
 create mode 100644 TodoSPA.sln
 create mode 100644 TodoSPA/App/Scripts/App.js
 create mode 100644 TodoSPA/App/Scripts/HomeController.js
 create mode 100644 TodoSPA/App/Scripts/IndexController.js
 create mode 100644 TodoSPA/App/Scripts/TodoListController.js
 create mode 100644 TodoSPA/App/Scripts/TodoListService.js
 create mode 100644 TodoSPA/App/Scripts/UserDataController.js
 create mode 100644 TodoSPA/App/Scripts/adal.js
 create mode 100644 TodoSPA/App/Views/Home.html
 create mode 100644 TodoSPA/App/Views/TodoList.html
 create mode 100644 TodoSPA/App/Views/UserData.html
 create mode 100644 TodoSPA/App_Start/Startup.Auth.cs
 create mode 100644 TodoSPA/App_Start/WebApiConfig.cs
 create mode 100644 TodoSPA/Controllers/TodoListController.cs
 create mode 100644 TodoSPA/DAL/TodoListServiceContext.cs
 create mode 100644 TodoSPA/DAL/TodoListServiceInitializer.cs
 create mode 100644 TodoSPA/Global.asax
 create mode 100644 TodoSPA/Global.asax.cs
 create mode 100644 TodoSPA/Models/AppModels.cs
 create mode 100644 TodoSPA/Properties/AssemblyInfo.cs
 create mode 100644 TodoSPA/Startup.cs
 create mode 100644 TodoSPA/TodoSPA.csproj
 create mode 100644 TodoSPA/Web.Debug.config
 create mode 100644 TodoSPA/Web.Release.config
 create mode 100644 TodoSPA/Web.config
 create mode 100644 TodoSPA/index.html
 create mode 100644 TodoSPA/packages.config

diff --git a/TodoSPA.sln b/TodoSPA.sln
new file mode 100644
index 0000000..0125a6b
--- /dev/null
+++ b/TodoSPA.sln
@@ -0,0 +1,22 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio 2013
+VisualStudioVersion = 12.0.30723.0
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TodoSPA", "TodoSPA\TodoSPA.csproj", "{C177F6EE-E7DB-4FA3-96A2-72CB04A98F68}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Release|Any CPU = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{C177F6EE-E7DB-4FA3-96A2-72CB04A98F68}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{C177F6EE-E7DB-4FA3-96A2-72CB04A98F68}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{C177F6EE-E7DB-4FA3-96A2-72CB04A98F68}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{C177F6EE-E7DB-4FA3-96A2-72CB04A98F68}.Release|Any CPU.Build.0 = Release|Any CPU
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+EndGlobal
diff --git a/TodoSPA/App/Scripts/App.js b/TodoSPA/App/Scripts/App.js
new file mode 100644
index 0000000..61131b3
--- /dev/null
+++ b/TodoSPA/App/Scripts/App.js
@@ -0,0 +1,28 @@
+'use strict';
+var app = angular.module('TodoSPA', ['ngRoute','AdalAngular']);
+// version 1
+app.config(['$routeProvider', '$httpProvider', 'adalAuthenticationServiceProvider', function ($routeProvider, $httpProvider, adalAuthenticationServiceProvider) {
+
+    $routeProvider.when("/Home", {
+        controller: "HomeController",
+        templateUrl: "/App/Views/Home.html",
+    }).when("/TodoList", {
+        controller: "TodoListController",
+        templateUrl: "/App/Views/TodoList.html",
+        requireADLogin: true,
+    }).when("/UserData", {
+        controller: "UserDataController",
+        templateUrl: "/App/Views/UserData.html",
+    }).otherwise({ redirectTo: "/Home" });
+
+    adalAuthenticationServiceProvider.init(
+        {
+            tenant: '52d4b072-9470-49fb-8721-bc3a1c9912a1',
+            clientId: 'e9a5a8b6-8af7-4719-9821-0deef255f68e',
+            instance: 'https://login.windows-ppe.net/',
+            extraQueryParameter: 'nux=1'
+        },
+        $httpProvider   // pass http provider to inject request interceptor to attach tokens
+        );
+   
+}]);
\ No newline at end of file
diff --git a/TodoSPA/App/Scripts/HomeController.js b/TodoSPA/App/Scripts/HomeController.js
new file mode 100644
index 0000000..73c0ee7
--- /dev/null
+++ b/TodoSPA/App/Scripts/HomeController.js
@@ -0,0 +1,11 @@
+app.controller('HomeController', ['$scope', 'adalAuthenticationService','$location', function ($scope, adalAuthenticationService, $location) {
+    $scope.Login = function () {
+        adalAuthenticationService.login();
+    };
+    $scope.Logout = function () {
+        adalAuthenticationService.logOut();
+    };
+    $scope.isActive = function (viewLocation) {        
+        return viewLocation === $location.path();
+    };
+}]);
\ No newline at end of file
diff --git a/TodoSPA/App/Scripts/IndexController.js b/TodoSPA/App/Scripts/IndexController.js
new file mode 100644
index 0000000..b87dcf6
--- /dev/null
+++ b/TodoSPA/App/Scripts/IndexController.js
@@ -0,0 +1,3 @@
+app.controller('IndexController', ['$scope', 'adalAuthenticationService', function ($scope, adalAuthenticationService) {
+
+}]);
\ No newline at end of file
diff --git a/TodoSPA/App/Scripts/TodoListController.js b/TodoSPA/App/Scripts/TodoListController.js
new file mode 100644
index 0000000..8d283b3
--- /dev/null
+++ b/TodoSPA/App/Scripts/TodoListController.js
@@ -0,0 +1,74 @@
+'use strict';
+app.controller('TodoListController', ['$scope', '$location', 'TodoListService', function ($scope, $location, TodoListService) {
+    $scope.error = "";
+    $scope.loadingMsg = "Loading...";
+    $scope.TodoList = null;
+    $scope.EditingInProgress = false;
+
+    $scope.NewTodo = {
+        Owner: "default",
+        Description: ""
+    };
+
+    $scope.EditInProgressTodo = {
+        Description: "",
+        ID: 0
+    };
+
+    $scope.InitNewTodo = function () {
+        $scope.NewTodo = {
+            Owner: "default",
+            Description: ""
+        };
+    };
+
+    $scope.EditSwitch = function (todo) {
+        todo.edit = !todo.edit;
+        if (todo.edit) {
+            $scope.EditInProgressTodo.Description = todo.Description;
+            $scope.EditInProgressTodo.ID = todo.ID;
+            $scope.EditingInProgress = true;
+        } else {
+            $scope.EditingInProgress = false;
+        }
+    };
+
+    $scope.Populate = function () {
+        TodoListService.getItems().success(function (results) {            
+            $scope.TodoList = results;
+            $scope.loadingMsg = "";
+        }).error(function (err) {
+            $scope.error = err;
+            $scope.loadingMsg = "";
+        })
+    };
+    $scope.Delete = function (id) {
+        TodoListService.deleteItem(id).success(function (results) {
+            $scope.loadingMsg = "";
+            $scope.Populate();
+        }).error(function (err) {
+            $scope.error = err;
+            $scope.loadingMsg = "";
+        })
+    };
+    $scope.Update = function (todo) {
+        TodoListService.putItem($scope.EditInProgressTodo).success(function (results) {
+            $scope.loadingMsg = "";
+            $scope.Populate();
+            $scope.EditSwitch(todo);
+        }).error(function (err) {
+            $scope.error = err;
+            $scope.loadingMsg = "";
+        })
+    };
+    $scope.Add = function () {        
+        TodoListService.postItem($scope.NewTodo).success(function (results) {
+            $scope.loadingMsg = "";
+            $scope.InitNewTodo();
+            $scope.Populate();
+        }).error(function (err) {
+            $scope.error = err;
+            $scope.loadingMsg = "";
+        })
+    };
+}]);
\ No newline at end of file
diff --git a/TodoSPA/App/Scripts/TodoListService.js b/TodoSPA/App/Scripts/TodoListService.js
new file mode 100644
index 0000000..ee1acf5
--- /dev/null
+++ b/TodoSPA/App/Scripts/TodoListService.js
@@ -0,0 +1,36 @@
+'use strict';
+app.factory('TodoListService', ['$http', function ($http) {
+    var serviceFactory = {};
+
+    var _getItems = function () {
+        return $http.get('/api/TodoList');
+    };
+
+    var _getItem = function (id) {
+        return $http.get('/api/TodoList/' + id);
+    };
+
+    var _postItem = function (data) {
+        return $http.post('/api/TodoList/',data);
+    };
+
+    var _putItem = function (data) {
+        return $http.put('/api/TodoList/', data);
+    };
+
+    var _deleteItem = function (id) {
+        return $http({
+            method: 'DELETE',
+            url: '/api/TodoList/' + id
+        });
+    };
+
+    serviceFactory.getItems = _getItems;
+    serviceFactory.getItem = _getItem;
+    serviceFactory.deleteItem = _deleteItem;
+    serviceFactory.postItem = _postItem;
+    serviceFactory.putItem = _putItem;
+
+    return serviceFactory;
+
+}]);
\ No newline at end of file
diff --git a/TodoSPA/App/Scripts/UserDataController.js b/TodoSPA/App/Scripts/UserDataController.js
new file mode 100644
index 0000000..0366b9e
--- /dev/null
+++ b/TodoSPA/App/Scripts/UserDataController.js
@@ -0,0 +1,4 @@
+app.controller('UserDataController', ['$scope', 'adalAuthenticationService', function ($scope, adalAuthenticationService) {
+
+
+}]);
\ No newline at end of file
diff --git a/TodoSPA/App/Scripts/adal.js b/TodoSPA/App/Scripts/adal.js
new file mode 100644
index 0000000..cac4785
--- /dev/null
+++ b/TodoSPA/App/Scripts/adal.js
@@ -0,0 +1,1277 @@
+//----------------------------------------------------------------------
+// @preserve Copyright (c) Microsoft Open Technologies, Inc.
+// All Rights Reserved
+// Apache License 2.0
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// 
+// http://www.apache.org/licenses/LICENSE-2.0
+// 
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+//----------------------------------------------------------------------
+'use strict';
+
+// node.js usage for tests
+var AuthenticationContext;
+if (typeof module !== 'undefined' && module.exports) {
+    var window, localStorage, angular, document;
+    module.exports.inject = function (windowInj, localStorageInj, documentInj, MathInj, angularInj, conf) {
+        window = windowInj;
+        localStorage = localStorageInj;
+        document = documentInj;
+        Math = MathInj; // jshint ignore:line
+        angular = angularInj;
+        return new AuthenticationContext(conf);
+    };
+}
+
+/**
+ * Config information
+ * @public
+ * @class Config
+ * @property {tenant}           Your tenant related your app
+ * @property {clientId}        App ID that you register at Azure Active Directory UX portal
+ * @property {redirectUri}     Redirect page that will receive the token
+ * @property {loginResource}    Resource to use to send request for login
+ * @property {instance}         Authorization server instance default:https://login.windows.net/
+ */
+
+/**
+* User information from idtoken.
+*  @class User
+*  @property {string} userName - username assigned from upn or email.
+*  @property {object} profile - properties parsed from idtoken.
+*/
+
+/**
+ * Creates a new AuthenticationContext object.
+ * @constructor
+ * @param {object}  config               Configuration options for AuthenticationContext
+ *
+ **/
+AuthenticationContext = function (config) {
+    /**
+    * Enum for request type
+    * @enum {string}
+    */
+    this.REQUEST_TYPE = {
+        LOGIN: 'LOGIN',
+        RENEW_TOKEN: 'RENEW_TOKEN',
+        ID_TOKEN: 'ID_TOKEN',
+        UNKNOWN: 'UNKNOWN'
+    };
+
+    /**
+    * Enum for storage constants
+    * @enum {string}
+    */
+    this.CONSTANTS = {
+        STORAGE: {
+            TOKEN_KEYS: 'adal.token.keys',
+            ACCESS_TOKEN_KEY: 'adal.access.token.key',
+            EXPIRATION_KEY: 'adal.expiration.key',
+            START_PAGE: 'adal.start.page',
+            FAILED_RENEW: 'adal.failed.renew',
+            STATE_LOGIN: 'adal.state.login',
+            STATE_RENEW: 'adal.state.renew',
+            STATE_RENEW_RESOURCE: 'adal.state.renew.resource',
+            STATE_IDTOKEN: 'adal.state.idtoken',
+            NONCE_IDTOKEN: 'adal.nonce.idtoken',
+            SESSION_STATE: 'adal.session.state',
+            USERNAME: 'adal.username',
+            IDTOKEN: 'adal.idtoken',
+            ERROR: 'adal.error',
+            ERROR_DESCRIPTION: 'adal.error.description',
+            LOGIN_REQUEST: 'adal.login.request',
+            LOGIN_ERROR: 'adal.login.error'
+        },
+        RESOURCE_DELIMETER: '|',
+        ERR_MESSAGES: {
+            NO_TOKEN: 'User is not authorized'
+        }
+    };
+
+    if (AuthenticationContext.prototype._singletonInstance) {
+        return AuthenticationContext.prototype._singletonInstance;
+    }
+    AuthenticationContext.prototype._singletonInstance = this;
+
+    // public
+    this.instance = 'https://login.windows.net/';
+    this.config = {};
+    this.callback = null;
+    this.popUp = false;
+
+    // private
+    this._user = null;
+    this._renewActive = false;
+    this._loginInProgress = false;
+    this._renewStates = [];
+
+    // validate before constructor assignments
+    if (config.displayCall && typeof config.displayCall !== 'function') {
+        throw new Error('displayCall is not a function');
+    }
+
+    if (!config.clientId) {
+        throw new Error('clientId is required');
+    }
+
+    this.config = this._cloneConfig(config);
+
+    // App can request idtoken for itself using clientid as resource
+    if (!this.config.loginResource) {
+        this.config.loginResource = this.config.clientId;
+    }
+
+    if (!this.config.redirectUri) {
+        this.config.redirectUri = window.location.href;
+    }
+
+    this.config.resource = this.config.loginResource || '';
+};
+
+/**
+ * Gets token for resource as loginResource and then gets user profile in iframe. 
+ * Redirect to callback page will process the fragment and store in localStorage.
+ */
+AuthenticationContext.prototype.login = function () {
+    // Token is not present and user needs to login
+    var expectedState = this._guid();
+    this.config.state = expectedState;
+    this._idTokenNonce = this._guid();
+    this._logstatus('Expected state: ' + expectedState + ' startPage:' + window.location);
+    this._saveItem(this.CONSTANTS.STORAGE.LOGIN_REQUEST, window.location);
+    this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, '');
+    this._saveItem(this.CONSTANTS.STORAGE.STATE_LOGIN, expectedState);
+    this._saveItem(this.CONSTANTS.STORAGE.NONCE_IDTOKEN, this._idTokenNonce);
+    this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, '');
+
+
+    var urlNavigate = this._getNavigateUrl('id_token', null) + '&nonce=' + encodeURIComponent(this._idTokenNonce);
+    this.frameCallInProgress = false;
+    this._loginInProgress = true;
+    if (this.config.displayCall) {
+        // User defined way of handling the navigation
+        this.config.displayCall(urlNavigate);
+    } else {
+        this.promptUser(urlNavigate);
+    }
+    // callback from redirected page will receive fragment. It needs to call oauth2Callback
+};
+
+AuthenticationContext.prototype.loginInProgress = function () {
+    return this._loginInProgress;
+};
+
+AuthenticationContext.prototype._hasResource = function (key) {
+    var keys = this._getItem(this.CONSTANTS.STORAGE.TOKEN_KEYS);
+    return keys && !this._isEmpty(keys) && (keys.indexOf(key + this.CONSTANTS.RESOURCE_DELIMETER) > -1);
+};
+
+/**
+* Gets token only from cache
+* @param {string}   resource A URI that identifies the resource for which the token is valid.
+* @returns {string} access token if exists and not expired or null
+*/
+AuthenticationContext.prototype.getCachedToken = function (resource) {
+    // TODO this will use cache key based on resource
+    if (!this._hasResource(resource)) {
+        return null;
+    }
+
+    var token = this._getItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY + resource);
+    var expired = this._getItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + resource);
+
+    // Expire before actual time based on config to renew token before expired
+    var offset = this.config.expireOffsetSeconds || 120;
+
+    if (expired && (expired > this._now() + offset)) {
+        return token;
+    } else {
+        this._saveItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY + resource, '');
+        this._saveItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + resource, 0);
+        return null;
+    }
+};
+
+/**
+* Gets user from cache. It does not do iframe call.
+* @returns {User} access token if exists and not expired or null
+*/
+AuthenticationContext.prototype.getCachedUser = function () {
+    if (this._user) {
+        return this._user;
+    }
+
+    var idtoken = this._getItem(this.CONSTANTS.STORAGE.IDTOKEN);
+    this._user = this._createUser(idtoken);
+    return this._user;
+};
+
+// var errorResponse = {error:'', errorDescription:''};
+// var token = 'string token';
+// callback(errorResponse, token)
+// with callback
+/**
+* Gets token with iframe
+* @param {string}   resource A URI that identifies the resource for which the token is valid.
+* @returns {string} access token if exists and not expired or null
+*/
+AuthenticationContext.prototype._renewToken = function (resource, callback) {
+    // use iframe to try refresh token
+    // use given resource to create new authz url
+    this._logstatus('renewToken is called for resource:' + resource);
+    if (!this._hasResource(resource)) {
+        var keys = this._getItem(this.CONSTANTS.STORAGE.TOKEN_KEYS) || '';
+        this._saveItem(this.CONSTANTS.STORAGE.TOKEN_KEYS, keys + resource + this.CONSTANTS.RESOURCE_DELIMETER);
+    }
+
+    var frameHandle = this._addAdalFrame('adalRenewFrame');
+    var expectedState = this._guid() + "|" +  resource;
+
+    this.config.state = expectedState;
+    // renew happens in iframe, so it keeps javascript context
+    this._renewStates.push(expectedState);
+
+    this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, '');
+
+    this._logstatus('Renew token Expected state: ' + expectedState);
+    var urlNavigate = this._getNavigateUrl('token', resource) + '&prompt=none&login_hint=' + encodeURIComponent(this._user.userName);
+    urlNavigate += '&domain_hint=' + encodeURIComponent(this._getDomainHint());
+    urlNavigate += '&nonce=' + encodeURIComponent(this._idTokenNonce);
+    this.callback = callback;
+    this.idTokenNonce = null;
+    this._logstatus('Navigate to:' + urlNavigate);
+    this._saveItem(this.CONSTANTS.STORAGE.LOGIN_REQUEST, '');
+    frameHandle.src = 'about:blank';
+    this._loadFrame(urlNavigate, 'adalRenewFrame');
+};
+
+AuthenticationContext.prototype._renewIdToken = function (callback) {
+    // use iframe to try refresh token
+    this._logstatus('renewIdToken is called');
+    if (!this._hasResource(this.config.clientId)) {
+        var keys = this._getItem(this.CONSTANTS.STORAGE.TOKEN_KEYS) || '';
+        this._saveItem(this.CONSTANTS.STORAGE.TOKEN_KEYS, keys + this.config.clientId + this.CONSTANTS.RESOURCE_DELIMETER);
+    }
+
+    var frameHandle = this._addAdalFrame('adalIdTokenFrame');
+    var expectedState = this._guid() + '|' + this.config.clientId;
+    this._idTokenNonce = this._guid();
+    this._saveItem(this.CONSTANTS.STORAGE.NONCE_IDTOKEN, this._idTokenNonce);
+    this.config.state = expectedState;
+    // renew happens in iframe, so it keeps javascript context
+    this._renewStates.push(expectedState);
+    this._saveItem(this.CONSTANTS.STORAGE.STATE_RENEW, expectedState);
+    this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, '');
+
+    this._logstatus('Renew token Expected state: ' + expectedState);
+    var urlNavigate = this._getNavigateUrl('id_token', null) + '&prompt=none&login_hint=' + encodeURIComponent(this._user.userName);
+    urlNavigate += '&domain_hint=' + encodeURIComponent(this._getDomainHint());
+    urlNavigate += '&nonce=' + encodeURIComponent(this._idTokenNonce);
+    this.callback = callback;
+    this.idTokenNonce = null;
+    this._logstatus('Navigate to:' + urlNavigate);
+    this._saveItem(this.CONSTANTS.STORAGE.LOGIN_REQUEST, '');
+    frameHandle.src = 'about:blank';
+    this._loadFrame(urlNavigate, 'adalIdTokenFrame')
+};
+
+
+AuthenticationContext.prototype._loadFrame = function (urlNavigate, frameName) {
+    // This trick overcomes iframe navigation in IE
+    // IE does not load the page consistently in iframe
+    var self = this;
+    setTimeout(function () {
+        var frameHandle = self._addAdalFrame(frameName);
+        if (frameHandle.src === '' || frameHandle.src === 'about:blank') {
+            frameHandle.src = urlNavigate;
+            self._loadFrame(urlNavigate);
+        }
+    }, 500);
+};
+
+/**
+* Gets token from cache if not expired and available. Gets token from iframe if expired.
+* @param {string}   resource A URI that identifies the resource for which the token is valid.
+* @param {requestCallback} callback 
+*/
+AuthenticationContext.prototype.acquireToken = function (resource, callback) {
+    if (this._isEmpty(resource)) {
+        callback('resource is required', null)
+        return;
+    }
+
+    var token = this.getCachedToken(resource);
+    if (token) {
+        this._logstatus('Token in cache');
+        callback(null, token);
+        return;
+    }
+
+    if (this._getItem(this.CONSTANTS.STORAGE.FAILED_RENEW)) {
+        this._logstatus('renewToken is failed:' + this._getItem(this.CONSTANTS.STORAGE.FAILED_RENEW));
+        callback(this._getItem(this.CONSTANTS.STORAGE.FAILED_RENEW), null);
+        return;
+    }
+
+    if (!this._user) {
+        callback('User login is required', null);
+        return;
+    }
+
+    // refresh attept with iframe
+    this._renewActive = true;
+    if (resource === this.config.clientId) {
+        // App uses idtoken to send to api endpoints
+        // Default resource is tracked as clientid to store this token
+        this._logstatus('renewing idtoken');
+        this._renewIdToken(callback);
+    } else {
+        this._renewToken(resource, callback);
+    }
+};
+
+/**
+* Redirect to url and prompt for credentials.
+* @param {string}   urlNavigate A URI that is related to the authorization endpoint
+*/
+AuthenticationContext.prototype.promptUser = function (urlNavigate) {
+    if (urlNavigate) {
+        this._logstatus('Navigate to:' + urlNavigate);
+        window.location.replace(urlNavigate);
+    } else {
+        this._logstatus('Navigate url is empty');
+    }
+};
+
+/**
+* Clear cache items.
+*/
+AuthenticationContext.prototype.clearCache = function () {
+    this._saveItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY, '');
+    this._saveItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY, 0);
+    this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, '');
+    this._saveItem(this.CONSTANTS.STORAGE.SESSION_STATE, '');
+    this._saveItem(this.CONSTANTS.STORAGE.STATE_LOGIN, '');
+    this._renewStates = [];
+    this._saveItem(this.CONSTANTS.STORAGE.STATE_IDTOKEN, '');
+    this._saveItem(this.CONSTANTS.STORAGE.START_PAGE, '');
+    this._saveItem(this.CONSTANTS.STORAGE.USERNAME, '');
+    this._saveItem(this.CONSTANTS.STORAGE.IDTOKEN, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, '');
+    var keys = this._getItem(this.CONSTANTS.STORAGE.TOKEN_KEYS);
+
+    if (!this._isEmpty(keys)) {
+        keys = keys.split(this.CONSTANTS.RESOURCE_DELIMETER);
+        for (var i = 0; i < keys.length; i++) {
+            this._saveItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY + keys[i], '');
+            this._saveItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + keys[i], 0);
+        }
+    }
+    this._saveItem(this.CONSTANTS.STORAGE.TOKEN_KEYS, '');
+};
+
+/**
+* Clear cache items for a resource.
+*/
+AuthenticationContext.prototype.clearCacheForResource = function (resource) {
+    // TODO allow firing renew for different resources at the same time
+    this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, '');
+    this._saveItem(this.CONSTANTS.STORAGE.STATE_RENEW, '');
+    this._saveItem(this.CONSTANTS.STORAGE.STATE_IDTOKEN, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, '');
+    if (this._hasResource(resource)) {
+        this._saveItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY + resource, '');
+        this._saveItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + resource, 0);
+    }
+};
+
+/**
+* Logout user will redirect page to logout endpoint. 
+* After logout, it will redirect to post_logout page if provided.
+*/
+AuthenticationContext.prototype.logOut = function () {
+    this.clearCache();
+    var tenant = 'common';
+    var logout = '';
+    this._user = null;
+    if (this.config.tenant) {
+        tenant = this.config.tenant;
+    }
+
+    if (this.config.instance) {
+        this.instance = this.config.instance;
+    }
+
+    if (this.config.postLogoutRedirectUri) {
+        logout = 'post_logout_redirect_uri=' + encodeURIComponent(this.config.postLogoutRedirectUri);
+    }
+
+    var urlNavigate = this.instance + tenant + '/oauth2/logout?' + logout;
+    this._logstatus('Logout navigate to: ' + urlNavigate);
+    this.promptUser(urlNavigate);
+};
+
+AuthenticationContext.prototype._isEmpty = function (str) {
+    return (typeof str === 'undefined' || !str || 0 === str.length);
+};
+
+/**
+ * This callback is displayed as part of the Requester class.
+ * @callback requestCallback
+ * @param {string} error
+ * @param {User} user
+ */
+
+/**
+ * Gets a user profile
+ * @param {requestCallback} cb - The callback that handles the response.
+ */
+AuthenticationContext.prototype.getUser = function (callback) {
+    // IDToken is first call
+    if (typeof callback !== 'function') {
+        throw new Error('callback is not a function');
+    }
+
+    this.callback = callback;
+
+    // user in memory
+    if (this._user) {
+        this.callback(null, this._user);
+        return;
+    }
+
+    // frame is used to get idtoken
+    var idtoken = this._getItem(this.CONSTANTS.STORAGE.IDTOKEN);
+    if (!this._isEmpty(idtoken)) {
+        this._logstatus('User exists in cache: ');
+        this._user = this._createUser(idtoken);
+        this.callback(null, this._user);
+    } else {
+        this.callback('User information is not available');
+    }
+};
+
+AuthenticationContext.prototype._getDomainHint = function () {
+    if (this._user && this._user.userName && this._user.userName.indexOf('@') > -1) {
+        var parts = this._user.userName.split('@');
+        // local part can include @ in quotes. Sending last part handles that.
+        return parts[parts.length - 1];
+    }
+
+    return '';
+};
+
+AuthenticationContext.prototype._createUser = function (idToken) {
+    var user = null;
+    var parsedJson = this._extractIdToken(idToken);
+    if (parsedJson && parsedJson.hasOwnProperty('aud')) {
+
+        if (parsedJson.aud.toLowerCase() === this.config.clientId.toLowerCase()) {
+
+            user = {
+                userName: '',
+                profile: parsedJson
+            };
+
+            if (parsedJson.hasOwnProperty('upn')) {
+                user.userName = parsedJson.upn;
+            } else if (parsedJson.hasOwnProperty('email')) {
+                user.userName = parsedJson.email;
+            }
+        } else {
+            this._logstatus('IdToken has invalid aud field');
+        }
+
+    }
+
+    return user;
+};
+
+AuthenticationContext.prototype._getHash = function (hash) {
+    if (hash.indexOf('#/') > -1) {
+        hash = hash.substring(hash.indexOf('#/') + 2);
+    } else if (hash.indexOf('#') > -1) {
+        hash = hash.substring(1);
+    }
+
+    return hash;
+};
+
+/**
+ * Checks if hash contains access token or id token or error_description
+ * @param {string} hash  -  Hash passed from redirect page
+ * @returns {Boolean}
+ */
+AuthenticationContext.prototype.isCallback = function (hash) {
+    hash = this._getHash(hash);
+    var parameters = this._deserialize(hash);
+    return (
+            parameters.hasOwnProperty('error_description') ||
+            parameters.hasOwnProperty('access_token') ||
+            parameters.hasOwnProperty('id_token')
+            );
+};
+
+/**
+ * Gets login error
+ * @returns {string} error message related to login
+ */
+AuthenticationContext.prototype.getLoginError = function () {
+    return this._getItem(this.CONSTANTS.STORAGE.LOGIN_ERROR);
+};
+
+/**
+ * Gets requestInfo from given hash.
+ * @returns {string} error message related to login
+ */
+AuthenticationContext.prototype.getRequestInfo = function (hash) {
+    hash = this._getHash(hash);
+    var parameters = this._deserialize(hash);
+    var requestInfo = { valid: false, parameters: {}, stateMatch: false, stateResponse: '', requestType: this.REQUEST_TYPE.UNKNOWN };
+    if (parameters) {
+        requestInfo.parameters = parameters;
+        if (parameters.hasOwnProperty('error_description') ||
+            parameters.hasOwnProperty('access_token') ||
+            parameters.hasOwnProperty('id_token')) {
+
+            requestInfo.valid = true;
+
+            // which call
+            var stateResponse = '';
+            if (parameters.hasOwnProperty('state')) {
+                this._logstatus('State: ' + parameters.state);
+                stateResponse = parameters.state;
+            } else {
+                this._logstatus('No state returned');
+            }
+
+            requestInfo.stateResponse = stateResponse;
+
+            // async calls can fire iframe and login request at the same time if developer does not use the API as expected
+            // incoming callback needs to be looked up to find the request type
+            switch (stateResponse) {
+                case this._getItem(this.CONSTANTS.STORAGE.STATE_LOGIN):
+                    requestInfo.requestType = this.REQUEST_TYPE.LOGIN;
+                    requestInfo.stateMatch = true;
+                    break;
+                
+                case this._getItem(this.CONSTANTS.STORAGE.STATE_IDTOKEN):
+                    requestInfo.requestType = this.REQUEST_TYPE.ID_TOKEN;
+                    this._saveItem(this.CONSTANTS.STORAGE.STATE_IDTOKEN, '');
+                    requestInfo.stateMatch = true;
+                    break;
+            }
+
+            // external api requests may have many renewtoken requests for different resource          
+            if (!requestInfo.stateMatch && window.parent && window.parent.AuthenticationContext()) {
+                var statesInParentContext = window.parent.AuthenticationContext()._renewStates;
+                for (var i = 0; i < statesInParentContext.length; i++) {
+                    if (statesInParentContext[i] === requestInfo.stateResponse) {
+                        requestInfo.requestType = this.REQUEST_TYPE.RENEW_TOKEN;
+                        requestInfo.stateMatch = true;
+                        break;
+                    }
+                }
+            }
+        }
+    }
+
+    return requestInfo;
+};
+
+AuthenticationContext.prototype._getResourceFromState = function (state) {
+    if (state) {
+        var splitIndex = state.indexOf('|');
+        if (splitIndex > -1 && splitIndex + 1 < state.length)
+            return state.substring(splitIndex + 1);
+    }
+
+    return '';
+}
+
+/**
+ * Saves token from hash that is received from redirect.
+ * @param {string} hash  -  Hash passed from redirect page
+ * @returns {string} error message related to login
+ */
+AuthenticationContext.prototype.saveTokenFromHash = function (requestInfo) {
+    this._logstatus('State status:' + requestInfo.stateMatch);
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR, '');
+    this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, '');
+
+    // Record error
+    if (requestInfo.parameters.hasOwnProperty('error_description')) {
+        this._logstatus('Error :' + requestInfo.parameters.error);
+        this._logstatus('Error description:' + requestInfo.parameters['error_description']);
+        this._saveItem(this.CONSTANTS.STORAGE.FAILED_RENEW, requestInfo.parameters['error_description']);
+        this._saveItem(this.CONSTANTS.STORAGE.ERROR, requestInfo.parameters.error);
+        this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, requestInfo.parameters['error_description']);
+
+        if (requestInfo.requestType === this.REQUEST_TYPE.LOGIN) {
+            this._loginInProgress = false;
+            this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, requestInfo.parameters.errorDescription);
+        } else {
+            this._renewActive = false;
+        }
+    } else {
+
+        // It must verify the state from redirect
+        if (requestInfo.stateMatch) {
+            // record tokens to storage if exists
+            this._logstatus('State is right');
+            if (requestInfo.parameters.hasOwnProperty('session_state')) {
+                this._saveItem(this.CONSTANTS.STORAGE.SESSION_STATE, requestInfo.parameters['session_state']);
+            }
+
+            if (requestInfo.parameters.hasOwnProperty('access_token')) {
+                this._logstatus('Fragment has access token');
+                // default resource
+                this._renewActive = false;
+                var resource = this.config.loginResource;
+                if (!this._hasResource(resource)) {
+                    var keys = this._getItem(this.CONSTANTS.STORAGE.TOKEN_KEYS) || '';
+                    this._saveItem(this.CONSTANTS.STORAGE.TOKEN_KEYS, keys + resource + this.CONSTANTS.RESOURCE_DELIMETER);
+                }
+
+                if (requestInfo.requestType === this.REQUEST_TYPE.RENEW_TOKEN) {                    
+                    resource = this._getResourceFromState(requestInfo.stateResponse);
+                }
+
+                // save token with related resource
+                this._saveItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY + resource, requestInfo.parameters['access_token']);
+                this._saveItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + resource, this._expiresIn(requestInfo.parameters['expires_in']));
+            }
+
+            if (requestInfo.parameters.hasOwnProperty('id_token')) {
+                this._loginInProgress = false;
+                this._user = this._createUser(requestInfo.parameters['id_token']);
+                if (this._user && this._user.profile) {
+                    if (this._user.profile.nonce !== this._getItem(this.CONSTANTS.STORAGE.NONCE_IDTOKEN)) {
+                        this._user = null;
+                        this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, 'Nonce is not same as ' + this._idTokenNonce);
+                    } else {
+                        this._saveItem(this.CONSTANTS.STORAGE.IDTOKEN, requestInfo.parameters['id_token']);
+
+                        // Save idtoken as access token for app itself
+                        var resource = this.config.clientId;
+                        if (!this._hasResource(resource)) {
+                            var keys = this._getItem(this.CONSTANTS.STORAGE.TOKEN_KEYS) || '';
+                            this._saveItem(this.CONSTANTS.STORAGE.TOKEN_KEYS, keys + resource + this.CONSTANTS.RESOURCE_DELIMETER);
+                        }
+                        this._saveItem(this.CONSTANTS.STORAGE.ACCESS_TOKEN_KEY + resource, requestInfo.parameters['id_token']);
+                        this._saveItem(this.CONSTANTS.STORAGE.EXPIRATION_KEY + resource, this._user.profile.exp);
+                    }
+                }
+            }
+        } else {
+            this._saveItem(this.CONSTANTS.STORAGE.ERROR, 'Invalid_state');
+            this._saveItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION, 'Invalid_state');
+            if (requestInfo.requestType === this.REQUEST_TYPE.LOGIN) {
+                this._saveItem(this.CONSTANTS.STORAGE.LOGIN_ERROR, 'State is not same as ' + requestInfo.stateResponse);
+            }
+        }
+    }
+};
+
+/**
+ * Gets resource for given endpoint if mapping is provided with config.
+ * @param {string} endpoint  -  API endoibt
+ * @returns {string} resource for this API endpoint
+ */
+AuthenticationContext.prototype.getResourceForEndpoint = function (endpoint) {
+    if (this.config && this.config.endpoints) {
+        for (var configEndpoint in this.config.endpoints) {
+            // configEndpoint is like /api/Todo requested endpoint can be /api/Todo/1
+            if (endpoint.indexOf(configEndpoint) > -1) {
+                return this.config.endpoints[configEndpoint];
+            }
+        }
+    }
+
+    // default resource will be clientid if nothing specified
+    // App will use idtoken for calls to itself
+    return this.config.loginResource;
+};
+
+/*exported  oauth2Callback */
+AuthenticationContext.prototype.handleWindowCallback = function () {
+    // This is for regular javascript usage for redirect handling
+    // need to make sure this is for callback
+    var hash = window.location.hash;
+    if (this.isCallback(hash)) {
+        var requestInfo = this.getRequestInfo(hash);
+        this.saveTokenFromHash(requestInfo);
+        var callback = null;
+        if ((requestInfo.requestType === this.REQUEST_TYPE.RENEW_TOKEN ||
+            requestInfo.requestType === this.REQUEST_TYPE.ID_TOKEN) &&
+            window.parent) {
+            // iframe call but same single page
+            console.log('Window is in iframe');
+            callback = window.parent.AuthenticationContext().callback;
+            window.src = '';
+        } else if (window && window.oauth2Callback) {
+            console.log('Window is redirecting');
+            callback = this.callback;
+        }
+
+        window.location.hash = '';
+        if (requestInfo.requestType === this.REQUEST_TYPE.RENEW_TOKEN) {
+            callback(this._getItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION), requestInfo.parameters['access_token']);
+            return;
+        } else if (requestInfo.requestType === this.REQUEST_TYPE.ID_TOKEN) {
+            // JS context may not have the user if callback page was different, so parse idtoken again to callback
+            callback(this._getItem(this.CONSTANTS.STORAGE.ERROR_DESCRIPTION), this._createUser(this._getItem(this.CONSTANTS.STORAGE.IDTOKEN)));
+            return;
+        }
+    }
+};
+
+AuthenticationContext.prototype._getNavigateUrl = function (responseType, resource) {
+    var tenant = 'common';
+    if (this.config.tenant) {
+        tenant = this.config.tenant;
+    }
+
+    if (this.config.instance) {
+        this.instance = this.config.instance;
+    }
+
+    var urlNavigate = this.instance + tenant + '/oauth2/authorize' + this._serialize(responseType, this.config, resource);
+    console.log('Navigate url:' + urlNavigate);
+    return urlNavigate;
+};
+
+AuthenticationContext.prototype._extractIdToken = function (encodedIdToken) {
+    // id token will be decoded to get the username
+    var crackedToken = this._crackJwt(encodedIdToken);
+    if (!crackedToken) {
+        return null;
+    }
+
+    try {
+        var base64IdToken = crackedToken.JWSPayload;
+        var base64Decoded = this._base64DecodeStringUrlSafe(base64IdToken);
+        if (!base64Decoded) {
+            this._logstatus('The returned id_token could not be base64 url safe decoded.');
+            return null;
+        }
+
+        // ECMA script has JSON built-in support
+        return JSON.parse(base64Decoded);
+    } catch (err) {
+        this._logstatus('The returned id_token could not be decoded: ' + err.stack);
+    }
+
+    return null;
+};
+
+AuthenticationContext.prototype._extractUserName = function (encodedIdToken) {
+    // id token will be decoded to get the username
+    try {
+        var parsed = this._extractIdToken(encodedIdToken);
+        if (parsed) {
+            if (parsed.hasOwnProperty('upn')) {
+                return parsed.upn;
+            } else if (parsed.hasOwnProperty('email')) {
+                return parsed.email;
+            }
+        }
+    } catch (err) {
+        this._logstatus('The returned id_token could not be decoded: ' + err.stack);
+    }
+
+    return null;
+};
+
+AuthenticationContext.prototype._base64DecodeStringUrlSafe = function (base64IdToken) {
+    // html5 should support atob function for decoding
+    if (window.atob) {
+        return window.atob(base64IdToken);
+    }
+
+    // TODO add support for this
+    this._logstatus('Browser is not supported');
+    return null;
+};
+
+// Adal.node js crack function
+AuthenticationContext.prototype._crackJwt = function (jwtToken) {
+    var idTokenPartsRegex = /^([^\.\s]*)\.([^\.\s]+)\.([^\.\s]*)$/;
+
+    var matches = idTokenPartsRegex.exec(jwtToken);
+    if (!matches || matches.length < 4) {
+        this._logstatus('The returned id_token is not parseable.');
+        return null;
+    }
+
+    var crackedToken = {
+        header: matches[1],
+        JWSPayload: matches[2],
+        JWSSig: matches[3]
+    };
+
+    return crackedToken;
+};
+
+AuthenticationContext.prototype._convertUrlSafeToRegularBase64EncodedString = function (str) {
+    return str.replace('-', '+').replace('_', '/');
+};
+
+AuthenticationContext.prototype._serialize = function (responseType, obj, resource) {
+    var str = [];
+    if (obj !== null) {
+        str.push('?response_type=' + responseType);
+        str.push('client_id=' + encodeURIComponent(obj.clientId));
+        if (resource) {
+            str.push('resource=' + encodeURIComponent(resource));
+        }
+
+        str.push('redirect_uri=' + encodeURIComponent(obj.redirectUri));
+        str.push('state=' + encodeURIComponent(obj.state));
+
+        if (obj.hasOwnProperty('slice')) {
+            str.push('slice=' + encodeURIComponent(obj.slice));
+        }
+
+        if (obj.hasOwnProperty('extraQueryParameter')) {
+            str.push(obj.extraQueryParameter);
+        }
+    }
+
+    return str.join('&');
+};
+
+AuthenticationContext.prototype._deserialize = function (query) {
+    var match,
+        pl = /\+/g,  // Regex for replacing addition symbol with a space
+        search = /([^&=]+)=?([^&]*)/g,
+        decode = function (s) { return decodeURIComponent(s.replace(pl, ' ')); },
+        obj = {};
+    match = search.exec(query);
+    while (match) {
+        obj[decode(match[1])] = decode(match[2]);
+        match = search.exec(query);
+    }
+
+    return obj;
+};
+
+/* jshint ignore:start */
+AuthenticationContext.prototype._guid = function () {
+    // RFC4122: The version 4 UUID is meant for generating UUIDs from truly-random or
+    // pseudo-random numbers.
+    // The algorithm is as follows:
+    //     Set the two most significant bits (bits 6 and 7) of the
+    //        clock_seq_hi_and_reserved to zero and one, respectively.
+    //     Set the four most significant bits (bits 12 through 15) of the
+    //        time_hi_and_version field to the 4-bit version number from
+    //        Section 4.1.3. Version4 
+    //     Set all the other bits to randomly (or pseudo-randomly) chosen
+    //     values.
+    // UUID                   = time-low "-" time-mid "-"time-high-and-version "-"clock-seq-reserved and low(2hexOctet)"-" node
+    // time-low               = 4hexOctet
+    // time-mid               = 2hexOctet
+    // time-high-and-version  = 2hexOctet
+    // clock-seq-and-reserved = hexOctet: 
+    // clock-seq-low          = hexOctet
+    // node                   = 6hexOctet
+    // Format: xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx
+    // y could be 1000, 1001, 1010, 1011 since most significant two bits needs to be 10
+    // y values are 8, 9, A, B
+    var guidHolder = 'xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx';
+    var hex = '0123456789abcdef';
+    var r = 0;
+    var guidResponse = "";
+    for (var i = 0; i < 36; i++) {
+        if (guidHolder[i] !== '-' && guidHolder[i] !== '4') {
+            // each x and y needs to be random
+            r = Math.random() * 16 | 0;
+        }
+
+        if (guidHolder[i] === 'x') {
+            guidResponse += hex[r];
+        } else if (guidHolder[i] === 'y') {
+            // clock-seq-and-reserved first hex is filtered and remaining hex values are random
+            r &= 0x3; // bit and with 0011 to set pos 2 to zero ?0??
+            r |= 0x8; // set pos 3 to 1 as 1???
+            guidResponse += hex[r];
+        } else {
+            guidResponse += guidHolder[i];
+        }
+    }
+
+    return guidResponse;
+};
+/* jshint ignore:end */
+
+AuthenticationContext.prototype._expiresIn = function (expires) {
+    return this._now() + parseInt(expires, 10);
+};
+
+AuthenticationContext.prototype._now = function () {
+    return Math.round(new Date().getTime() / 1000.0);
+};
+
+
+AuthenticationContext.prototype._addAdalFrame = function (iframeId) {
+    this._logstatus('Add adal frame to document:' + iframeId);
+    var adalFrame = document.getElementById(iframeId);
+
+    if (!adalFrame) {
+        if (document.createElement && document.documentElement &&
+            (window.opera || window.navigator.userAgent.indexOf('MSIE 5.0') === -1)) {
+            var ifr = document.createElement('iframe');
+            ifr.setAttribute('id', iframeId);
+            ifr.style.visibility = 'hidden';
+            ifr.style.position = 'absolute';
+            ifr.style.width = ifr.style.height = ifr.borderWidth = '0px';
+
+            adalFrame = document.getElementsByTagName('body')[0].appendChild(ifr);
+        }
+        else if (document.body && document.body.insertAdjacentHTML) {
+            document.body.insertAdjacentHTML('beforeEnd', '<iframe name="' + iframeId + '" id="' + iframeId + '" style="display:none"></iframe>');
+        }
+        if (window.frames && window.frames[iframeId]) {
+            adalFrame = window.frames[iframeId];
+        }
+    }
+
+    return adalFrame;
+};
+
+AuthenticationContext.prototype._logstatus = function (msg) {
+    if (console) {
+        console.log(msg);
+    }
+};
+
+AuthenticationContext.prototype._saveItem = function (key, obj) {
+    if (!this._supportsLocalStorage()) {
+        this._logStatus('Local storage is not supported');
+        return false;
+    }
+
+    localStorage.setItem(key, obj);
+
+    return true;
+};
+
+AuthenticationContext.prototype._getItem = function (key) {
+    if (!this._supportsLocalStorage()) {
+        this._logstatus('Local storage is not supported');
+        return null;
+    }
+
+    return localStorage.getItem(key);
+};
+
+AuthenticationContext.prototype._supportsLocalStorage = function () {
+    try {
+        return 'localStorage' in window && window['localStorage'];
+    } catch (e) {
+        return false;
+    }
+};
+
+AuthenticationContext.prototype._cloneConfig = function (obj) {
+    if (null === obj || 'object' !== typeof obj) {
+        return obj;
+    }
+
+    var copy = {};
+    for (var attr in obj) {
+        if (obj.hasOwnProperty(attr)) {
+            copy[attr] = obj[attr];
+        }
+    }
+    return copy;
+};
+
+// ============= Angular modules- Start =============
+if (typeof angular !== 'undefined') {
+
+    var AdalModule = angular.module('AdalAngular', []);
+
+    // Interceptor for http if needed
+    AdalModule.factory('ProtectedResourceInterceptor', ['$q', '$rootScope', '$injector', function ($q, $rootScope, $injector) {
+        var authService;
+        var injectAuthService = function () {
+            authService = authService || $injector.get('adalAuthenticationService');
+        };
+
+        return {
+            request: function (config) {
+                if (config) {
+                    if (!$injector.has('adalAuthenticationService')) {
+                        return config;
+                    }
+                    injectAuthService();
+                    // This interceptor needs to load service, but dependeny definition causes circular reference error.
+                    // Loading with injector is suggested at github. https://github.com/angular/angular.js/issues/2367
+                    authService = authService || $injector.get('adalAuthenticationService');
+                    config.headers = config.headers || {};
+
+                    var resource = authService.getResourceForEndpoint(config.url);
+                    var tokenStored = authService.getCachedToken(resource);
+                    if (tokenStored) {
+                        // check endpoint mapping if provided
+                        config.headers.Authorization = 'Bearer ' + tokenStored;
+                        return config;
+                    } else {
+                        // Cancel request if login is starting
+                        if (authService.loginInProgress()) {
+                            $q.reject();
+                            return;
+                        } else if (authService.config && resource !== authService.config.clientId) {
+                            // external endpoints
+                            // delayed request to return after iframe completes
+                            var delayedRequest = $q.defer();
+                            authService.acquireToken(resource).then(function (token) {
+                                config.headers.Authorization = 'Bearer ' + token;
+                                delayedRequest.resolve(config);
+                            }, function (err) {
+                                this._logstatus('err :' + error);
+                                delayedRequest.reject(err);
+                            });
+
+                            return delayedRequest.promise;
+                        }
+                    }
+                }
+            },
+            responseError: function (rejection) {
+                if (rejection.status === 401) {
+                    // TODO check challange header. If www-Authenticate, send event
+                    // Send event for unauthorized so that app can handle this
+                    // provide resource that sends 401 based on declared endpoint mapping
+                    injectAuthService();
+                    var resource = authService.getResourceForEndpoint(rejection.config.url);
+                    authService.clearCacheForResource(resource);
+                    $rootScope.$broadcast('adal:notAuthorized', rejection, resource);
+                }
+
+                return $q.reject(rejection);
+            }
+        };
+    }]);
+
+    var AdalService = function () {
+        var _adal = null;
+        var _oauthData = { isAuthenticated: false, userName: '', loginError: '', profile: '' };
+
+        var updateDataFromCache = function (resource) {
+            // only cache lookup here to not interrupt with events
+            var token = _adal.getCachedToken(resource);
+            _oauthData.isAuthenticated = token !== null && token.length > 0;
+            var user = _adal.getCachedUser() || { userName: '' };
+            _oauthData.userName = user.userName;
+            _oauthData.profile = user.profile;
+            _oauthData.loginError = _adal.getLoginError();
+        };
+
+        this.init = function (configOptions, httpProvider) {
+            if (configOptions) {
+                // redirect and logout_redirect are set to current location by default
+                var existingHash = window.location.hash;
+                var pathDefault = window.location.href;
+                if (existingHash) {
+                    pathDefault = pathDefault.replace(existingHash, '');
+                }
+                configOptions.redirectUri = configOptions.redirectUri || pathDefault;
+                configOptions.postLogoutRedirectUri = configOptions.postLogoutRedirectUri || pathDefault;
+
+                if (httpProvider && httpProvider.interceptors) {
+                    httpProvider.interceptors.push('ProtectedResourceInterceptor');
+                }
+
+                // create instance with given config
+                _adal = new AuthenticationContext(configOptions);
+            } else {
+                throw new Error('You must set configOptions, when calling init');
+            }
+
+            // loginresource is used to set authenticated status
+            updateDataFromCache(_adal.config.loginResource);
+        };
+
+        // special function that exposes methods in Angular controller
+        // $rootScope, $window, $http, $q, $location, $timeout are injected by Angular
+        this.$get = function ($rootScope, $window, $http, $q, $location, $timeout) {
+
+            var locationChangeHandler = function (event, newUrl, oldUrl) {
+                var hash = $window.location.hash;
+
+                if (_adal.isCallback(hash)) {
+                    // callback can come from login or iframe request
+
+                    var requestInfo = _adal.getRequestInfo(hash);
+                    _adal.saveTokenFromHash(requestInfo);
+                    $window.location.hash = '';
+
+                    if (requestInfo.requestType !== _adal.REQUEST_TYPE.LOGIN) {
+                        _adal.callback = $window.parent.AuthenticationContext().callback;
+                    }
+
+                    // Return to callback if it is send from iframe
+                    if (requestInfo.stateMatch) {
+                        if (typeof _adal.callback === 'function') {
+                            // Call within the same context without full page redirect keeps the callback
+                            if (requestInfo.requestType === _adal.REQUEST_TYPE.RENEW_TOKEN) {
+                                // Idtoken or Accestoken can be renewed
+                                if (requestInfo.parameters['access_token']) {
+                                    _adal.callback(_adal._getItem(_adal.CONSTANTS.STORAGE.ERROR_DESCRIPTION), requestInfo.parameters['access_token']);
+                                    return;
+                                } else if (requestInfo.parameters['id_token']) {
+                                    _adal.callback(_adal._getItem(_adal.CONSTANTS.STORAGE.ERROR_DESCRIPTION), requestInfo.parameters['id_token']);
+                                    return;
+                                }
+                            }
+                        } else {
+                            // normal full login redirect happened on the page
+                            updateDataFromCache(_adal.config.loginResource);
+                            if (_oauthData.userName) {
+                                //IDtoken is added as token for the app
+                                $timeout(function () {
+                                    updateDataFromCache(_adal.config.loginResource);
+                                    $rootScope.userInfo = _oauthData;
+                                    // redirect to login requested page
+                                    var loginStartPage = _adal._getItem(_adal.CONSTANTS.STORAGE.START_PAGE);
+                                    if (loginStartPage) {
+                                        $location.path(loginStartPage);
+                                    }
+                                }, 1);
+                                $rootScope.$broadcast('adal:loginSuccess');
+                            } else {
+                                $rootScope.$broadcast('adal:loginFailure', _adal._getItem(_adal.CONSTANTS.STORAGE.ERROR_DESCRIPTION));
+                            }
+                        }
+                    }
+                } else {
+                    // No callback. App resumes after closing or moving to new page.
+                    // Check token and username             
+                    updateDataFromCache(_adal.config.loginResource);
+                    if (!_adal._renewActive && !_oauthData.isAuthenticated && _oauthData.userName) {
+                        if (!_adal._getItem(_adal.CONSTANTS.STORAGE.FAILED_RENEW)) {
+                            _adal.acquireToken(_adal.config.loginResource, function (error, tokenOut) {
+                                if (error) {
+                                    $rootScope.$broadcast('adal:loginFailure', 'auto renew failure');
+                                } else {
+                                    if (tokenOut) {
+                                        _oauthData.isAuthenticated = true;
+                                    }
+                                }
+                            });
+                        }
+                    }
+                }
+
+                $timeout(function () {
+                    updateDataFromCache(_adal.config.loginResource);
+                    $rootScope.userInfo = _oauthData;
+                }, 1);
+            };
+
+            var routeChangeHandler = function (e, nextRoute) {
+                if (nextRoute.$$route && nextRoute.$$route.requireADLogin) {
+                    if (!_oauthData.isAuthenticated) {
+                        console.log('Route change event for:' + nextRoute.$$route.originalPath);
+                        if (_adal.config && _adal.config.localLoginUrl) {
+                            $location.path(_adal.config.localLoginUrl);
+                        } else {
+                            // directly start login flow
+                            _adal._saveItem(_adal.CONSTANTS.STORAGE.START_PAGE, nextRoute.$$route.originalPath);
+                            console.log('Start login at:' + window.location.href);
+                            $rootScope.$broadcast('adal:loginRedirect');
+                            _adal.login();
+                        }
+                    }
+                }
+            };
+
+            // Route change event tracking to receive fragment and also auto renew tokens
+            $rootScope.$on('$routeChangeStart', routeChangeHandler);
+
+            $rootScope.$on('$locationChangeStart', locationChangeHandler);
+
+            updateDataFromCache(_adal.config.loginResource);
+            $rootScope.userInfo = _oauthData;
+
+            return {
+                // public methods will be here that are accessible from Controller
+                config: _adal.config,
+                login: function () {
+                    _adal.login();
+                },
+                loginInProgress: function () {
+                    return _adal.loginInProgress();
+                },
+                logOut: function () {
+                    _adal.logOut();
+                    //call signout related method
+                },
+                getCachedToken: function (resource) {
+                    return _adal.getCachedToken(resource);
+                },
+                userInfo: _oauthData,
+                acquireToken: function (resource) {
+                    // automated token request call
+                    var deferred = $q.defer();
+                    _adal.acquireToken(resource, function (error, tokenOut) {
+                        if (error) {
+                            this._logstatus('err :' + error);
+                            deferred.reject(error);
+                        } else {
+                            deferred.resolve(tokenOut);
+                        }
+                    });
+
+                    return deferred.promise;
+                },
+                getUser: function () {
+                    var deferred = $q.defer();
+                    _adal.getUser(function (error, user) {
+                        if (error) {
+                            this._logstatus('err :' + error);
+                            deferred.reject(error);
+                        } else {
+                            deferred.resolve(user);
+                        }
+                    });
+
+                    return deferred.promise;
+                },
+                getResourceForEndpoint: function (endpoint) {
+                    return _adal.getResourceForEndpoint(endpoint);
+                },
+                clearCache: function () {
+                    _adal.clearCache();
+                },
+                clearCacheForResource: function (resource) {
+                    _adal.clearCacheForResource(resource);
+                }
+            };
+        };
+    };
+
+    // Service that is accessible at config to init and controllers to use API methods
+    AdalModule.provider('adalAuthenticationService', function () {
+        return new AdalService();
+    });
+} else {
+    console.log('Angular.JS is not included');
+}
+
+// ============= Angular modules- End =============
diff --git a/TodoSPA/App/Views/Home.html b/TodoSPA/App/Views/Home.html
new file mode 100644
index 0000000..49f14e1
--- /dev/null
+++ b/TodoSPA/App/Views/Home.html
@@ -0,0 +1,3 @@
+<div>
+    home sweet home
+</div>
diff --git a/TodoSPA/App/Views/TodoList.html b/TodoSPA/App/Views/TodoList.html
new file mode 100644
index 0000000..431d8cd
--- /dev/null
+++ b/TodoSPA/App/Views/TodoList.html
@@ -0,0 +1,27 @@
+<div ng-init="Populate()">
+    <p class="error">{{error}}</p>
+    <p>{{loadingMsg}}</p>
+    <div class="panel">
+        <div class="input-group">
+            <input ng-model="NewTodo.Description" class="form-control" />
+            <span class="input-group-btn">
+                <button ng-click="Add();" class="btn btn-default">Add</button>
+            </span>
+        </div>
+        <table class="table table-striped">
+            <tbody>
+                <tr data-ng-repeat="item in TodoList">
+                    <td>
+                        <p data-ng-hide="item.edit">{{ item.Description }}</p>
+                        <input data-ng-show="item.edit" type="text" data-ng-model="EditInProgressTodo.Description" class="form-control" />                        
+                    </td>
+                    <td>
+                        <p data-ng-hide="item.edit || EditingInProgress"><a data-ng-click="EditSwitch(item)" href="javascript:;">Edit</a> | <a data-ng-click="Delete(item.ID)" href="javascript:;">Delete</a></p>
+                        <p data-ng-show="item.edit"><a data-ng-click="Update(item)" href="javascript:;">Save</a> | <a data-ng-click="EditSwitch(item)" href="javascript:;">Cancel</a></p>                       
+                    </td>
+
+                </tr>
+            </tbody>
+        </table>
+    </div>
+</div>
\ No newline at end of file
diff --git a/TodoSPA/App/Views/UserData.html b/TodoSPA/App/Views/UserData.html
new file mode 100644
index 0000000..cacd57e
--- /dev/null
+++ b/TodoSPA/App/Views/UserData.html
@@ -0,0 +1,23 @@
+<div>
+    <h3>
+        Id_token content
+    </h3>
+    <p>{{userInfo.userName}}</p>
+    <p>aud:{{userInfo.profile.aud}}</p>
+    <p>iss:{{userInfo.profile.iss}}</p>
+    <p>iat:{{userInfo.profile.iat}}</p>
+    <p>nbf:{{userInfo.profile.nbf}}</p>
+    <p>exp:{{userInfo.profile.exp}}</p>
+    <p>ver:{{userInfo.profile.ver}}</p>
+    <p>tid:{{userInfo.profile.tid}}</p>
+    <p>amr:{{userInfo.profile.amr}}</p>
+    <p>oid:{{userInfo.profile.oid}}</p>
+    <p>upn:{{userInfo.profile.upn}}</p>
+    <p>unique_name:{{userInfo.profile.unique_name}}</p>
+    <p>sub:{{userInfo.profile.sub}}</p>
+    <p>family_name:{{userInfo.profile.family_name}}</p>
+    <p>given_name:{{userInfo.profile.given_name}}</p>
+    <p>pwd_exp:{{userInfo.profile.pwd_exp}}</p>
+    <p>pwd_url:{{userInfo.profile.pwd_url}}</p>
+
+</div>
\ No newline at end of file
diff --git a/TodoSPA/App_Start/Startup.Auth.cs b/TodoSPA/App_Start/Startup.Auth.cs
new file mode 100644
index 0000000..0d6a939
--- /dev/null
+++ b/TodoSPA/App_Start/Startup.Auth.cs
@@ -0,0 +1,24 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.Owin;
+using Owin;
+using Microsoft.Owin.Security.ActiveDirectory;
+using System.Configuration;
+
+namespace TodoSPA
+{
+    public partial class Startup
+    {
+        public void ConfigureAuth(IAppBuilder app)
+        {
+            app.UseWindowsAzureActiveDirectoryBearerAuthentication(
+                new WindowsAzureActiveDirectoryBearerAuthenticationOptions
+                {
+                    Audience = ConfigurationManager.AppSettings["ida:Audience"],
+                    //Tenant = ConfigurationManager.AppSettings["ida:Tenant"],
+                    MetadataAddress = "https://login.windows-ppe.net/52d4b072-9470-49fb-8721-bc3a1c9912a1/federationmetadata/2007-06/federationmetadata.xml"
+                });
+        }
+
+    }
+}
diff --git a/TodoSPA/App_Start/WebApiConfig.cs b/TodoSPA/App_Start/WebApiConfig.cs
new file mode 100644
index 0000000..ba4bb4b
--- /dev/null
+++ b/TodoSPA/App_Start/WebApiConfig.cs
@@ -0,0 +1,24 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Web.Http;
+
+namespace TodoSPA
+{
+    public static class WebApiConfig
+    {
+        public static void Register(HttpConfiguration config)
+        {
+            // Web API configuration and services
+
+            // Web API routes
+            config.MapHttpAttributeRoutes();
+
+            config.Routes.MapHttpRoute(
+                name: "DefaultApi",
+                routeTemplate: "api/{controller}/{id}",
+                defaults: new { id = RouteParameter.Optional }
+            );
+        }
+    }
+}
diff --git a/TodoSPA/Controllers/TodoListController.cs b/TodoSPA/Controllers/TodoListController.cs
new file mode 100644
index 0000000..57aae9a
--- /dev/null
+++ b/TodoSPA/Controllers/TodoListController.cs
@@ -0,0 +1,131 @@
+using System;
+using System.Collections.Generic;
+using System.Collections.Concurrent;
+using System.Linq;
+using System.Net;
+using System.Net.Http;
+using System.Web.Http;
+using System.Security.Claims;
+using TodoSPA.DAL;
+
+namespace TodoSPA.Controllers
+{
+    //[Authorize]
+    //public class TodoListController : ApiController
+    //{
+    //    private static List<Todo> todos = new List<Todo>();
+
+    //    // GET: api/TodoList
+    //    public IEnumerable<Todo> Get()
+    //    {
+    //        //todos.Add(new Todo { Description = "aa", ID = 1, Owner = "mario" });
+    //        //todos.Add(new Todo { Description = "bb", ID = 2, Owner = "luigi" });
+    //        string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+    //        return todos;
+            
+    //        //IEnumerable<Todo> currentUserToDos = todos.Where(a => a.Owner == owner);
+    //        //return currentUserToDos;
+    //    }
+
+    //    // GET: api/TodoList/5
+    //    public Todo Get(int id)
+    //    {
+    //        //string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+    //        //Todo todo = todos.First(a => a.Owner == owner && a.ID == id); 
+    //        Todo todo = todos.First(a => a.ID == id); 
+           
+    //        return todo;
+    //    }
+
+    //    // POST: api/TodoList
+    //    public void Post(Todo todo)
+    //    {
+    //        //string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+    //        //todo.Owner = owner;
+    //        lock (todos)
+    //        {
+    //            todo.ID = new Random().Next(10000000);
+    //            todos.Add(todo);
+    //        }
+    //    }
+
+    //    public void Put(Todo todo)
+    //    {
+    //        Todo xtodo = todos.First(a => a.ID == todo.ID);
+    //        if (todo != null)
+    //        {
+    //            todos.Remove(xtodo);
+    //            todos.Add(todo);
+    //        }
+    //    }
+
+    //    // DELETE: api/TodoList/5
+    //    public void Delete(int id)
+    //    {
+    //        //string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+    //        lock (todos)
+    //        {                
+    //            //Todo todo = todos.First(a => a.Owner == owner && a.ID == id);
+    //            Todo todo = todos.First(a => a.ID == id);
+    //            if (todo != null)
+    //            {
+    //                todos.Remove(todo);
+    //            }
+    //        }
+    //    }
+    //}
+
+    [Authorize]
+    public class TodoListController : ApiController
+    {
+        private TodoListServiceContext db = new TodoListServiceContext();
+
+        // GET: api/TodoList
+        public IEnumerable<Todo> Get()
+        {
+            string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+            IEnumerable<Todo> currentUserToDos = db.Todoes.Where(a => a.Owner == owner);
+            return currentUserToDos;
+        }
+
+        // GET: api/TodoList/5
+        public Todo Get(int id)
+        {
+            string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+            Todo todo = db.Todoes.First(a => a.Owner == owner && a.ID == id);             
+            return todo;
+        }
+
+        // POST: api/TodoList
+        public void Post(Todo todo)
+        {
+            string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;            
+            todo.Owner = owner;
+            db.Todoes.Add(todo);
+            db.SaveChanges();            
+        }
+
+        public void Put(Todo todo)
+        {
+            string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+            Todo xtodo = db.Todoes.First(a => a.Owner == owner && a.ID == todo.ID);
+            if (todo != null)
+            {
+                xtodo.Description = todo.Description;
+                db.SaveChanges();
+            }
+        }
+
+        // DELETE: api/TodoList/5
+        public void Delete(int id)
+        {
+            string owner = ClaimsPrincipal.Current.FindFirst(ClaimTypes.NameIdentifier).Value;
+            Todo todo = db.Todoes.First(a => a.Owner == owner && a.ID == id);
+            if (todo != null)
+            {
+                db.Todoes.Remove(todo);
+                db.SaveChanges();
+            }
+        }        
+    }
+}
diff --git a/TodoSPA/DAL/TodoListServiceContext.cs b/TodoSPA/DAL/TodoListServiceContext.cs
new file mode 100644
index 0000000..aafb24e
--- /dev/null
+++ b/TodoSPA/DAL/TodoListServiceContext.cs
@@ -0,0 +1,22 @@
+using System;
+using System.Collections.Generic;
+using System.Data.Entity;
+using System.Data.Entity.ModelConfiguration.Conventions;
+using System.Linq;
+using System.Web;
+using TodoSPA.Controllers;
+
+namespace TodoSPA.DAL
+{
+    public class TodoListServiceContext: DbContext
+    {
+        public TodoListServiceContext()
+            : base("TodoListServiceContext")
+        { }
+        public DbSet<Todo> Todoes { get; set; }
+        protected override void OnModelCreating(DbModelBuilder modelBuilder)
+        {
+            modelBuilder.Conventions.Remove<PluralizingTableNameConvention>();
+        }
+    }
+}
\ No newline at end of file
diff --git a/TodoSPA/DAL/TodoListServiceInitializer.cs b/TodoSPA/DAL/TodoListServiceInitializer.cs
new file mode 100644
index 0000000..c886356
--- /dev/null
+++ b/TodoSPA/DAL/TodoListServiceInitializer.cs
@@ -0,0 +1,11 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Web;
+
+namespace TodoSPA.DAL
+{
+    public class TodoListServiceInitializer : System.Data.Entity.DropCreateDatabaseIfModelChanges<TodoListServiceContext>
+    {
+    }
+}
\ No newline at end of file
diff --git a/TodoSPA/Global.asax b/TodoSPA/Global.asax
new file mode 100644
index 0000000..cc5d6e1
--- /dev/null
+++ b/TodoSPA/Global.asax
@@ -0,0 +1 @@
+<%@ Application Codebehind="Global.asax.cs" Inherits="TodoSPA.WebApiApplication" Language="C#" %>
diff --git a/TodoSPA/Global.asax.cs b/TodoSPA/Global.asax.cs
new file mode 100644
index 0000000..6808e2d
--- /dev/null
+++ b/TodoSPA/Global.asax.cs
@@ -0,0 +1,20 @@
+using System;
+using System.Collections.Generic;
+using System.Data.Entity;
+using System.Linq;
+using System.Web;
+using System.Web.Http;
+using System.Web.Routing;
+using TodoSPA.DAL;
+
+namespace TodoSPA
+{
+    public class WebApiApplication : System.Web.HttpApplication
+    {
+        protected void Application_Start()
+        {
+            Database.SetInitializer<TodoListServiceContext>(new TodoListServiceInitializer());
+            GlobalConfiguration.Configure(WebApiConfig.Register);
+        }
+    }
+}
diff --git a/TodoSPA/Models/AppModels.cs b/TodoSPA/Models/AppModels.cs
new file mode 100644
index 0000000..da94c89
--- /dev/null
+++ b/TodoSPA/Models/AppModels.cs
@@ -0,0 +1,12 @@
+
+namespace TodoSPA.Controllers
+{
+    public class Todo 
+     { 
+         public int ID { get; set; } 
+         public string Description { get; set; }
+         public string Owner { get; set; } 
+     } 
+
+
+}
\ No newline at end of file
diff --git a/TodoSPA/Properties/AssemblyInfo.cs b/TodoSPA/Properties/AssemblyInfo.cs
new file mode 100644
index 0000000..a787fd0
--- /dev/null
+++ b/TodoSPA/Properties/AssemblyInfo.cs
@@ -0,0 +1,35 @@
+using System.Reflection;
+using System.Runtime.CompilerServices;
+using System.Runtime.InteropServices;
+
+// General Information about an assembly is controlled through the following 
+// set of attributes. Change these attribute values to modify the information
+// associated with an assembly.
+[assembly: AssemblyTitle("TodoSPA")]
+[assembly: AssemblyDescription("")]
+[assembly: AssemblyConfiguration("")]
+[assembly: AssemblyCompany("")]
+[assembly: AssemblyProduct("TodoSPA")]
+[assembly: AssemblyCopyright("Copyright ©  2014")]
+[assembly: AssemblyTrademark("")]
+[assembly: AssemblyCulture("")]
+
+// Setting ComVisible to false makes the types in this assembly not visible 
+// to COM components.  If you need to access a type in this assembly from 
+// COM, set the ComVisible attribute to true on that type.
+[assembly: ComVisible(false)]
+
+// The following GUID is for the ID of the typelib if this project is exposed to COM
+[assembly: Guid("9f3a34b5-fd0f-4232-8bca-df6e5963b80b")]
+
+// Version information for an assembly consists of the following four values:
+//
+//      Major Version
+//      Minor Version 
+//      Build Number
+//      Revision
+//
+// You can specify all the values or you can default the Revision and Build Numbers 
+// by using the '*' as shown below:
+[assembly: AssemblyVersion("1.0.0.0")]
+[assembly: AssemblyFileVersion("1.0.0.0")]
diff --git a/TodoSPA/Startup.cs b/TodoSPA/Startup.cs
new file mode 100644
index 0000000..be8e0e4
--- /dev/null
+++ b/TodoSPA/Startup.cs
@@ -0,0 +1,17 @@
+using System;
+using System.Threading.Tasks;
+using Microsoft.Owin;
+using Owin;
+
+[assembly: OwinStartup(typeof(TodoSPA.Startup))]
+
+namespace TodoSPA
+{
+    public partial class Startup
+    {
+        public void Configuration(IAppBuilder app)
+        {
+            ConfigureAuth(app);
+        }
+    }
+}
diff --git a/TodoSPA/TodoSPA.csproj b/TodoSPA/TodoSPA.csproj
new file mode 100644
index 0000000..67d9aaa
--- /dev/null
+++ b/TodoSPA/TodoSPA.csproj
@@ -0,0 +1,178 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="12.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProductVersion>
+    </ProductVersion>
+    <SchemaVersion>2.0</SchemaVersion>
+    <ProjectGuid>{C177F6EE-E7DB-4FA3-96A2-72CB04A98F68}</ProjectGuid>
+    <ProjectTypeGuids>{349c5851-65df-11da-9384-00065b846f21};{fae04ec0-301f-11d3-bf4b-00c04f79efbc}</ProjectTypeGuids>
+    <OutputType>Library</OutputType>
+    <AppDesignerFolder>Properties</AppDesignerFolder>
+    <RootNamespace>TodoSPA</RootNamespace>
+    <AssemblyName>TodoSPA</AssemblyName>
+    <TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
+    <UseIISExpress>true</UseIISExpress>
+    <IISExpressSSLPort>44326</IISExpressSSLPort>
+    <IISExpressAnonymousAuthentication>enabled</IISExpressAnonymousAuthentication>
+    <IISExpressWindowsAuthentication>disabled</IISExpressWindowsAuthentication>
+    <IISExpressUseClassicPipelineMode>false</IISExpressUseClassicPipelineMode>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="EntityFramework">
+      <HintPath>..\packages\EntityFramework.6.1.1\lib\net45\EntityFramework.dll</HintPath>
+    </Reference>
+    <Reference Include="EntityFramework.SqlServer">
+      <HintPath>..\packages\EntityFramework.6.1.1\lib\net45\EntityFramework.SqlServer.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="Microsoft.Owin">
+      <HintPath>..\packages\Microsoft.Owin.3.0.0\lib\net45\Microsoft.Owin.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.Owin.Host.SystemWeb">
+      <HintPath>..\packages\Microsoft.Owin.Host.SystemWeb.3.0.0\lib\net45\Microsoft.Owin.Host.SystemWeb.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.Owin.Security">
+      <HintPath>..\packages\Microsoft.Owin.Security.3.0.0\lib\net45\Microsoft.Owin.Security.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.Owin.Security.ActiveDirectory">
+      <HintPath>..\packages\Microsoft.Owin.Security.ActiveDirectory.3.0.0\lib\net45\Microsoft.Owin.Security.ActiveDirectory.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.Owin.Security.Jwt">
+      <HintPath>..\packages\Microsoft.Owin.Security.Jwt.3.0.0\lib\net45\Microsoft.Owin.Security.Jwt.dll</HintPath>
+    </Reference>
+    <Reference Include="Microsoft.Owin.Security.OAuth">
+      <HintPath>..\packages\Microsoft.Owin.Security.OAuth.3.0.0\lib\net45\Microsoft.Owin.Security.OAuth.dll</HintPath>
+    </Reference>
+    <Reference Include="Newtonsoft.Json, Version=6.0.0.0, Culture=neutral, PublicKeyToken=30ad4fe6b2a6aeed, processorArchitecture=MSIL">
+      <SpecificVersion>False</SpecificVersion>
+      <HintPath>..\packages\Newtonsoft.Json.6.0.4\lib\net45\Newtonsoft.Json.dll</HintPath>
+    </Reference>
+    <Reference Include="Owin">
+      <HintPath>..\packages\Owin.1.0\lib\net40\Owin.dll</HintPath>
+    </Reference>
+    <Reference Include="System.IdentityModel.Tokens.Jwt">
+      <HintPath>..\packages\System.IdentityModel.Tokens.Jwt.4.0.0\lib\net45\System.IdentityModel.Tokens.Jwt.dll</HintPath>
+    </Reference>
+    <Reference Include="System.Net.Http" />
+    <Reference Include="System.Net.Http.WebRequest" />
+    <Reference Include="System.Web.DynamicData" />
+    <Reference Include="System.Web.Entity" />
+    <Reference Include="System.Web.ApplicationServices" />
+    <Reference Include="System.ComponentModel.DataAnnotations" />
+    <Reference Include="System" />
+    <Reference Include="System.Data" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Data.DataSetExtensions" />
+    <Reference Include="System.Web.Extensions" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Web" />
+    <Reference Include="System.Xml" />
+    <Reference Include="System.Configuration" />
+    <Reference Include="System.Web.Services" />
+    <Reference Include="System.EnterpriseServices" />
+  </ItemGroup>
+  <ItemGroup>
+    <Reference Include="System.Net.Http.Formatting">
+      <HintPath>..\packages\Microsoft.AspNet.WebApi.Client.5.2.0\lib\net45\System.Net.Http.Formatting.dll</HintPath>
+    </Reference>
+    <Reference Include="System.Web.Http">
+      <HintPath>..\packages\Microsoft.AspNet.WebApi.Core.5.2.0\lib\net45\System.Web.Http.dll</HintPath>
+    </Reference>
+    <Reference Include="System.Web.Http.WebHost">
+      <HintPath>..\packages\Microsoft.AspNet.WebApi.WebHost.5.2.0\lib\net45\System.Web.Http.WebHost.dll</HintPath>
+    </Reference>
+  </ItemGroup>
+  <ItemGroup>
+    <Content Include="App\Scripts\adal.js" />
+    <Content Include="App\Scripts\App.js" />
+    <Content Include="App\Scripts\HomeController.js" />
+    <Content Include="App\Scripts\IndexController.js" />
+    <Content Include="App\Scripts\TodoListController.js" />
+    <Content Include="App\Scripts\TodoListService.js" />
+    <Content Include="App\Scripts\UserDataController.js" />
+    <Content Include="App\Views\Home.html" />
+    <Content Include="App\Views\TodoList.html" />
+    <Content Include="App\Views\UserData.html" />
+    <Content Include="Global.asax" />
+    <Content Include="index.html" />
+    <Content Include="Web.config" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="App_Start\Startup.Auth.cs" />
+    <Compile Include="App_Start\WebApiConfig.cs" />
+    <Compile Include="Controllers\TodoListController.cs" />
+    <Compile Include="DAL\TodoListServiceContext.cs" />
+    <Compile Include="DAL\TodoListServiceInitializer.cs" />
+    <Compile Include="Global.asax.cs">
+      <DependentUpon>Global.asax</DependentUpon>
+    </Compile>
+    <Compile Include="Models\AppModels.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Startup.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <Content Include="packages.config" />
+    <None Include="Web.Debug.config">
+      <DependentUpon>Web.config</DependentUpon>
+    </None>
+    <None Include="Web.Release.config">
+      <DependentUpon>Web.config</DependentUpon>
+    </None>
+  </ItemGroup>
+  <ItemGroup>
+    <Folder Include="App_Data\" />
+  </ItemGroup>
+  <PropertyGroup>
+    <VisualStudioVersion Condition="'$(VisualStudioVersion)' == ''">10.0</VisualStudioVersion>
+    <VSToolsPath Condition="'$(VSToolsPath)' == ''">$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v$(VisualStudioVersion)</VSToolsPath>
+  </PropertyGroup>
+  <Import Project="$(MSBuildBinPath)\Microsoft.CSharp.targets" />
+  <Import Project="$(VSToolsPath)\WebApplications\Microsoft.WebApplication.targets" Condition="'$(VSToolsPath)' != ''" />
+  <Import Project="$(MSBuildExtensionsPath32)\Microsoft\VisualStudio\v10.0\WebApplications\Microsoft.WebApplication.targets" Condition="false" />
+  <ProjectExtensions>
+    <VisualStudio>
+      <FlavorProperties GUID="{349c5851-65df-11da-9384-00065b846f21}">
+        <WebProjectProperties>
+          <UseIIS>True</UseIIS>
+          <AutoAssignPort>True</AutoAssignPort>
+          <DevelopmentServerPort>14823</DevelopmentServerPort>
+          <DevelopmentServerVPath>/</DevelopmentServerVPath>
+          <IISUrl>http://localhost:49724/</IISUrl>
+          <NTLMAuthentication>False</NTLMAuthentication>
+          <UseCustomServer>False</UseCustomServer>
+          <CustomServerUrl>
+          </CustomServerUrl>
+          <SaveServerSettingsInUserFile>False</SaveServerSettingsInUserFile>
+        </WebProjectProperties>
+      </FlavorProperties>
+    </VisualStudio>
+  </ProjectExtensions>
+  <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
+       Other similar extension points exist, see Microsoft.Common.targets.
+  <Target Name="BeforeBuild">
+  </Target>
+  <Target Name="AfterBuild">
+  </Target>
+  -->
+</Project>
\ No newline at end of file
diff --git a/TodoSPA/Web.Debug.config b/TodoSPA/Web.Debug.config
new file mode 100644
index 0000000..2e302f9
--- /dev/null
+++ b/TodoSPA/Web.Debug.config
@@ -0,0 +1,30 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!-- For more information on using web.config transformation visit http://go.microsoft.com/fwlink/?LinkId=125889 -->
+
+<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
+  <!--
+    In the example below, the "SetAttributes" transform will change the value of 
+    "connectionString" to use "ReleaseSQLServer" only when the "Match" locator 
+    finds an attribute "name" that has a value of "MyDB".
+    
+    <connectionStrings>
+      <add name="MyDB" 
+        connectionString="Data Source=ReleaseSQLServer;Initial Catalog=MyReleaseDB;Integrated Security=True" 
+        xdt:Transform="SetAttributes" xdt:Locator="Match(name)"/>
+    </connectionStrings>
+  -->
+  <system.web>
+    <!--
+      In the example below, the "Replace" transform will replace the entire 
+      <customErrors> section of your web.config file.
+      Note that because there is only one customErrors section under the 
+      <system.web> node, there is no need to use the "xdt:Locator" attribute.
+      
+      <customErrors defaultRedirect="GenericError.htm"
+        mode="RemoteOnly" xdt:Transform="Replace">
+        <error statusCode="500" redirect="InternalError.htm"/>
+      </customErrors>
+    -->
+  </system.web>
+</configuration>
\ No newline at end of file
diff --git a/TodoSPA/Web.Release.config b/TodoSPA/Web.Release.config
new file mode 100644
index 0000000..c358444
--- /dev/null
+++ b/TodoSPA/Web.Release.config
@@ -0,0 +1,31 @@
+<?xml version="1.0" encoding="utf-8"?>
+
+<!-- For more information on using web.config transformation visit http://go.microsoft.com/fwlink/?LinkId=125889 -->
+
+<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
+  <!--
+    In the example below, the "SetAttributes" transform will change the value of 
+    "connectionString" to use "ReleaseSQLServer" only when the "Match" locator 
+    finds an attribute "name" that has a value of "MyDB".
+    
+    <connectionStrings>
+      <add name="MyDB" 
+        connectionString="Data Source=ReleaseSQLServer;Initial Catalog=MyReleaseDB;Integrated Security=True" 
+        xdt:Transform="SetAttributes" xdt:Locator="Match(name)"/>
+    </connectionStrings>
+  -->
+  <system.web>
+    <compilation xdt:Transform="RemoveAttributes(debug)" />
+    <!--
+      In the example below, the "Replace" transform will replace the entire 
+      <customErrors> section of your web.config file.
+      Note that because there is only one customErrors section under the 
+      <system.web> node, there is no need to use the "xdt:Locator" attribute.
+      
+      <customErrors defaultRedirect="GenericError.htm"
+        mode="RemoteOnly" xdt:Transform="Replace">
+        <error statusCode="500" redirect="InternalError.htm"/>
+      </customErrors>
+    -->
+  </system.web>
+</configuration>
\ No newline at end of file
diff --git a/TodoSPA/Web.config b/TodoSPA/Web.config
new file mode 100644
index 0000000..2ac105c
--- /dev/null
+++ b/TodoSPA/Web.config
@@ -0,0 +1,66 @@
+<?xml version="1.0" encoding="utf-8"?>
+<!--
+  For more information on how to configure your ASP.NET application, please visit
+  http://go.microsoft.com/fwlink/?LinkId=301879
+  -->
+<configuration>
+  <configSections>
+    <!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 -->
+    <section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" />
+  </configSections>
+  <appSettings>
+    <add key="ida:Tenant" value="52d4b072-9470-49fb-8721-bc3a1c9912a1" />
+    <add key="ida:Audience" value="e9a5a8b6-8af7-4719-9821-0deef255f68e" />
+    <add key="ida:ClientID" value="e9a5a8b6-8af7-4719-9821-0deef255f68e" />
+  </appSettings>
+  <system.web>
+    <compilation debug="true" targetFramework="4.5" />
+    <httpRuntime targetFramework="4.5" />
+  </system.web>
+  <system.webServer>
+    <handlers>
+      <remove name="ExtensionlessUrlHandler-Integrated-4.0" />
+      <remove name="OPTIONSVerbHandler" />
+      <remove name="TRACEVerbHandler" />
+      <add name="ExtensionlessUrlHandler-Integrated-4.0" path="*." verb="*" type="System.Web.Handlers.TransferRequestHandler" preCondition="integratedMode,runtimeVersionv4.0" />
+    </handlers>
+  </system.webServer>
+  <runtime>
+    <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
+      <dependentAssembly>
+        <assemblyIdentity name="Newtonsoft.Json" culture="neutral" publicKeyToken="30ad4fe6b2a6aeed" />
+        <bindingRedirect oldVersion="0.0.0.0-6.0.0.0" newVersion="6.0.0.0" />
+      </dependentAssembly>
+      <dependentAssembly>
+        <assemblyIdentity name="System.Web.Helpers" publicKeyToken="31bf3856ad364e35" />
+        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
+      </dependentAssembly>
+      <dependentAssembly>
+        <assemblyIdentity name="System.Web.Mvc" publicKeyToken="31bf3856ad364e35" />
+        <bindingRedirect oldVersion="1.0.0.0-5.2.0.0" newVersion="5.2.0.0" />
+      </dependentAssembly>
+      <dependentAssembly>
+        <assemblyIdentity name="System.Web.Optimization" publicKeyToken="31bf3856ad364e35" />
+        <bindingRedirect oldVersion="1.0.0.0-1.1.0.0" newVersion="1.1.0.0" />
+      </dependentAssembly>
+      <dependentAssembly>
+        <assemblyIdentity name="System.Web.WebPages" publicKeyToken="31bf3856ad364e35" />
+        <bindingRedirect oldVersion="1.0.0.0-3.0.0.0" newVersion="3.0.0.0" />
+      </dependentAssembly>
+      <dependentAssembly>
+        <assemblyIdentity name="WebGrease" publicKeyToken="31bf3856ad364e35" />
+        <bindingRedirect oldVersion="1.0.0.0-1.5.2.14234" newVersion="1.5.2.14234" />
+      </dependentAssembly>
+    </assemblyBinding>
+  </runtime>
+  <entityFramework>
+    <defaultConnectionFactory type="System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework">
+      <parameters>
+        <parameter value="v11.0" />
+      </parameters>
+    </defaultConnectionFactory>
+    <providers>
+      <provider invariantName="System.Data.SqlClient" type="System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer" />
+    </providers>
+  </entityFramework>
+</configuration>
\ No newline at end of file
diff --git a/TodoSPA/index.html b/TodoSPA/index.html
new file mode 100644
index 0000000..8c1bf71
--- /dev/null
+++ b/TodoSPA/index.html
@@ -0,0 +1,67 @@
+<!DOCTYPE html>
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <title>Todo List: a SPA sample demonstrating Azure AD and ADAL JS</title>
+    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap.min.css">
+    <link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/css/bootstrap-theme.min.css">
+</head>
+<body ng-app="TodoSPA" ng-controller="HomeController" role="document">
+
+    
+    <div class="navbar navbar-inverse navbar-fixed-top" role="navigation">
+        <div class="container">
+            <div class="navbar-header">
+                <button type="button" class="navbar-toggle collapsed"
+                         data-toggle="collapse" 
+                        data-target=".navbar-collapse">
+                    
+                    <span class="icon-bar"></span>
+                    <span class="icon-bar"></span>
+                    <span class="icon-bar"></span>
+                </button>
+                <a class="navbar-brand" href="#/Home">ADAL JS Sample</a>
+            </div>
+            <div class="navbar-collapse collapse">
+                <ul class="nav navbar-nav">
+                    <li ng-class="{ active: isActive('/Home') }"><a href="#/Home">Home</a></li>
+                    <li ng-class="{ active: isActive('/TodoList') }"><a href="#/TodoList">Todo List</a></li>
+                    <li ng-class="{ active: isActive('/UserData') }"><a href="#/UserData" ng-show="userInfo.isAuthenticated">User</a></li>                    
+                </ul>
+                <ul class="nav navbar-nav navbar-right">
+                    <li><button class="btn btn-link" ng-show="userInfo.isAuthenticated" ng-click="Logout()">Logout</button></li>
+                    <li><button class="btn btn-link" ng-hide=" userInfo.isAuthenticated" ng-click="Login()">Login</button></li>
+                </ul>
+            </div>
+        </div>
+    </div>
+    
+
+    <br />
+    <div class="container" role="main">
+         <div class="row">
+            <div class="col-xs-10 col-xs-offset-1" style="background-color:azure">
+                <div class="page-header">
+                    <h1>Todo List</h1>
+                </div>
+                <p>This sample demonstrates how to take advantage of ADAL JS for adding Azure AD authentication to your AngularJS apps.</p>               
+            </div>
+        </div>
+        <div class="row">
+            <div class="col-xs-10 col-xs-offset-1">
+                <div ng-view class="panel-body">
+
+                </div>
+            </div>
+        </div>
+        <script src="https://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script>
+        <script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.2.25/angular.min.js"></script>
+        <script src="https://code.angularjs.org/1.2.25/angular-route.js"></script>
+        <script src="https://maxcdn.bootstrapcdn.com/bootstrap/3.2.0/js/bootstrap.min.js"></script>
+        <script src="App/Scripts/adal.js"></script>
+        <script src="App/Scripts/App.js"></script>
+        <script src="App/Scripts/HomeController.js"></script>
+        <script src="App/Scripts/UserDataController.js"></script>
+        <script src="App/Scripts/TodoListController.js"></script>
+        <script src="App/Scripts/TodoListService.js"></script>
+</body>
+</html>
\ No newline at end of file
diff --git a/TodoSPA/packages.config b/TodoSPA/packages.config
new file mode 100644
index 0000000..e9ba038
--- /dev/null
+++ b/TodoSPA/packages.config
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="utf-8"?>
+<packages>
+  <package id="EntityFramework" version="6.1.1" targetFramework="net45" />
+  <package id="Microsoft.AspNet.WebApi" version="5.2.0" targetFramework="net45" />
+  <package id="Microsoft.AspNet.WebApi.Client" version="5.2.0" targetFramework="net45" />
+  <package id="Microsoft.AspNet.WebApi.Core" version="5.2.0" targetFramework="net45" />
+  <package id="Microsoft.AspNet.WebApi.WebHost" version="5.2.0" targetFramework="net45" />
+  <package id="Microsoft.Owin" version="3.0.0" targetFramework="net45" />
+  <package id="Microsoft.Owin.Host.SystemWeb" version="3.0.0" targetFramework="net45" />
+  <package id="Microsoft.Owin.Security" version="3.0.0" targetFramework="net45" />
+  <package id="Microsoft.Owin.Security.ActiveDirectory" version="3.0.0" targetFramework="net45" />
+  <package id="Microsoft.Owin.Security.Jwt" version="3.0.0" targetFramework="net45" />
+  <package id="Microsoft.Owin.Security.OAuth" version="3.0.0" targetFramework="net45" />
+  <package id="Newtonsoft.Json" version="6.0.4" targetFramework="net45" />
+  <package id="Owin" version="1.0" targetFramework="net45" />
+  <package id="System.IdentityModel.Tokens.Jwt" version="4.0.0" targetFramework="net45" />
+</packages>
\ No newline at end of file