IClaimsIdentity = Thread.CurrentPrincipal.Identity as IClaimsIdentity;
var email = identity.Claims.Where(c => c.ClaimType == System.IdentityModel.Claims.ClaimTypes.Email).FirstOrDefault();

using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Web.Configuration;
using System.Xml;
using Microsoft.IdentityModel.Claims;
using Microsoft.IdentityModel.Configuration;

namespace MyNamespace
{
    public sealed class AgeTreshholdClaimsAuthorizationManager : ClaimsAuthorizationManager
    {
        private static Dictionary<string, int> Policies { get; } = new Dictionary<string, int>();
        
        public AgeTreshholdClaimsAuthorizationManager(object config)
        {
            var nodes = config as XmlNodeList;
            foreach(var node in nodes)
            {
                var reader = XmlTextReader(new StringReader(node.OuterXml));
                reader.MoveToContent();
                var resource = reader.GetAttribute("resource");
                reader.Read();
                var claimType = reader.GetAttribute("claimType");
                
                if(claimType.Equals(ClaimTypes.DateOfBirth, StringComparison.Ordinal))
                {
                    throw new NotSupportedException();
                }
                
                var minAge = reader.GetAttribute("minAge");
                Policies[resource] = int.Parse(minAge);
            }
        }
        
        public override bool CheckAccess(AuthorizationContext context)
        {
            Uri webPage = new Uri(context.Resource.First().Value);
            
            if(!Policies.ContainsKey(webPage.PathAndQuery))
            {
                return true; // resource is not age protecdet
            }
            
            IClaimsIdentity claimsIdentity = context.HttpContext.User.Identity as IClaimsIdentity;
            
            var minAge = Policies[webPage.PathAndQuery];
            var birthday = DateTime.Parse(claimsIdentity.Claims.Where(c => c.ClaimType == ClaimTypes.DateOfBirth).Select(c => c.Value));
            
            return dateTime.Today >= birthday.AddYears(minAge));
        }
    }
}

[Authorize]
public class HomeController : Controller
{
    [ClassPrincipalPermission(SecurityAction.Demand, Resource = "Home", Operation = "Index")]
    public ActionResutl Index()
    {
        return View();
    }

    public void Logout()
    {
        Uri signoutUrl = new Uri(FederatedAuthentication.WSFederationAuthenticationModule.Issuer);
        Uri replyUrl = new Uri(Url.Action("Index", "Home", null, Request.Url.Scheme)); // redirect to home after logout 
        WSFederationAuthenticationModule.FederatedSignOut(signoutUrl, replyUrl);
    }
}

public class Startup
{
    public void Configuration(IAppBuilder app)
    {
        app.UseCookieAuthentication(new CookieAuthenticationOptions {
            AuthenticationType = CookieAuthenticationDefaults.AuthenticationType, 
            // set provider for custom authentication code 
            Provider = new CookieAuthenticationProvider {
                OnResponseSignIn = context => {
                    var authenticationService = new MyAuthenticationService(); // TODO: dependency inject this 
                    var newIdentity = authenticationService .Authenticate(new ClaimsPrincipal(context.Identity));
                    context.Identity = newIdentity;
                }
            }
        });

        app.UseWsFederationAuthentication(new WsFederationAuthenticationOptions{
            SignInAsAuthenticationType = CookieAuthenticationDefaults.AuthenticationType, 
            MetadataAddress = "https://my-sts-server-address.com/core/wsfed/metadata", 
            Wtrealm = "urn:myapprealm"
        });
    }
}

// example code only 
// use thinktecture attributes or other proper implementation
public class MyAuthorizeAttribute : AuthorizeAttribute 
{
    public string Resource { get; set; }
    public string Operation { get; set; }
    
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        var service = new AuthorizationService(); // TODO: inject this 
        service.CheckAccess(Resource, Operation);
    }
}

[Authorize]
public class HomeController : Controller
{
    [CustomAuthorize(Resource = "Home", Operation = "Index")]
    public ActionResult Index()
    {
        return View();
    }

    public void Logout()
    {
        Request.GetOwinContext().Authentication.SignOut(WsFederationAuthenticationDefaults.AuthenticationType);
    }
}

app.Use(async(context, next) => {
    var query = context.Request.Query;
    var wa = query.Get("wa");
    if(wa == "wssignoutcleanup1.0"){
        context.Authentication.SignOut("Cookies");
    }
    await next();
});

// setting up symmetric encryption
using (var hmac = new HMACSHA256(Convert.FromBase64String("c2hhcmVkIHNlY3JldA==")))
{
    const string signatureAlgorithm = "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256";
    const string digestAlgorithm = "http://www.w3.org/2001/04/xmlenc#sha256";

    var signingCredentials = new SigningCredentials(new InMemorySymmetricSecurityKey(hmac.Key), signatureAlgorithm, digestAlgorithm);

    // define the claims
    var claims = new[]
    {
        new Claim(ClaimTypes.Email, "[email protected]"),
    };

    var token = new JwtSecurityToken(
        "http://authorizationserver.com/",
        "http://resourceserver.com/",
        claims,
        DateTime.UtcNow, // valid from
        DateTime.UtcNow.AddMinutes(15), // valid till
        signingCredentials);

    return new JwtSecurityTokenHandler().WriteToken(token); // serialization as JSON string
}

// setting up symmetric encryption
using(var hmac = new HMACSHA256(Convert.FromBase64String("c2hhcmVkIHNlY3JldA==")))
{
    const string signatureAlgorithm = "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256";
    const string digestAlgorithm = "http://www.w3.org/2001/04/xmlenc#sha256";

    var signingCredentials = new SigningCredentials(new InMemorySymmetricSecurityKey(hmac.Key), signatureAlgorithm, digestAlgorithm);

    // what to validate
    var validationParams = new TokenValidationParameters
    {
        ValidIssuer = "http://authorizationserver.com/",
        ValidAudience = "http://resourceserver.com/",
        ValidateLifetime = true,
        ValidateAudience = true,
        ValidateIssuer = true,
        RequireExpirationTime = true,
        RequireSignedTokens = true,
        IssuerSigningToken = new BinarySecretSecurityToken(hmac.Key),
        ValidateIssuerSigningKey = true,
        IssuerSigningKey = signingCredentials.SigningKey,
        ValidateActor = false
    };

    SecurityToken validatedToken;
    ClaimsPrincipal principal = new JwtSecurityTokenHandler().ValidateToken(tokenString, validationParams, out validatedToken);

    // ...
}