public async Task<IActionResult> AuthenticateUser(
        [FromBody] LoginInputModel model,
        [FromServices] AzureB2CUserService userService
        )
    {
        var context = new ResourceOwnerPasswordValidationContext { Password = model.Password, UserName = model.Username };

        await userService.ValidateAsync(context);

        if (context.Result.Subject != null)
        {
            AuthenticationProperties props = null;
            // only set explicit expiration here if persistent.
            // otherwise we reply upon expiration configured in cookie middleware.
            if (AccountOptions.AllowRememberLogin && model.RememberLogin)
            {
                props = new AuthenticationProperties
                {
                    IsPersistent = true,
                    ExpiresUtc = DateTimeOffset.UtcNow.Add(AccountOptions.RememberMeLoginDuration)
                };
            };

            // issue authentication cookie with subject ID and username
            //   var user = _users.FindByUsername(model.Username);
            await HttpContext.SignInAsync(context.Result.Subject.GetSubjectId(), model.Username, props, context.Result.Subject.Claims.ToArray());

            return Ok(context.Result);

        }

        ModelState.AddModelError("", AccountOptions.InvalidCredentialsErrorMessage);

        return BadRequest(ModelState);

    }