I have a OWIN Middleware for authentication. We have two type of authentication in place. First type is bearer token using the following configuration

var OAuthOptions =  new OAuthAuthorizationServerOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ExternalBearer,
        TokenEndpointPath = new PathString("/Token"),
        Provider = new ApplicationOAuthProvider(PublicClientId),
        AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
        AllowInsecureHttp = true,
        AccessTokenFormat = new SecureTokenFormatter(GetMachineKey())
    };

And second type use authentication cookie for external Login

app.UseCookieAuthentication(new CookieAuthenticationOptions
{
    AuthenticationType = DefaultAuthenticationTypes.ExternalCookie,
    AuthenticationMode = Microsoft.Owin.Security.AuthenticationMode.Passive,
    CookieHttpOnly = true,
    CookieSecure = CookieSecureOption.SameAsRequest,
    CookieName = ".AspNet." + DefaultAuthenticationTypes.ExternalCookie,
    ExpireTimeSpan = TimeSpan.FromMinutes(5),
    TicketDataFormat = new SecureTokenFormatter(GetMachineKey())
});

When the User Logout, we actually issue two Logout

Request.GetOwinContext().Authentication.SignOut(DefaultAuthenticationTypes.ExternalCookie);

And

Request.GetOwinContext().Authentication.SignOut(DefaultAuthenticationTypes.ExternalBearer);

With the first one, I am expecting to see the .AspNet.ExternalCookie Cookie deleted from the Browser, which is not. With the second one, I am expecting to get my Token invalidated and The User.Current.Identity = null, which is not.

So how I can 1) Physically logout the current Identity for the current Session? 2) Remove the external Cookie from the Browser?