IdentityServer4 Password Grant
<p>I've stood up an instance of identityserver4, an API project, and a UI.  </p>

<p>The workflow is as follows:  </p>

<ol>
<li>User visits the UI.</li>
<li>User provides user name and password to UI.</li>
<li>UI sends credentials to back of web app, which uses a password grant to authenticate the user with IdentityServer4.</li>
<li>IdentityServer4 returns a token.</li>
<li>Token is used to identify who the user is to the UI and that the user has access to certain sections of the site.</li>
<li>When the user needs to do something within the site, the token is passed to the API via bearer auth.  </li>
</ol>

<p>The password grant isn't negotiable, as this is a first party app and it makes no sense to redirect the user away from the main site.  </p>

<p>What's the proper set of middleware to use for this?  Should I just use a CookieAuthenticationMiddleware and attach the token as a claim?  I'll need to access the claims from HttpContext.User claims.  Do I need to use IdentityMiddleware?</p>