title: Authentication when using Security Token Service
body: <p>I have created a Security Token Service (STS), an service with a reference to the STS and an example desktop application.</p>
  
  <p>This works as expected when using Windows authentication and Message security, a token is retrieved from the STS and the service method is called successfully.  The service returns a string containing the current users identity, which returns my AD username.</p>
  
  <p>I have a requirement however to authenticate against a database rather than AD.  I have tried creating a CustomUserNameValidator (in the STS, is this the correct place?) and referencing it in the web.config.  I then provide the credentials as shown below.</p>
  
  <p><code>SampleServiceReference.SampleServiceClient client = new SampleServiceReference.SampleServiceClient();
  client.ClientCredentials.UserName.UserName
      = "alex";
  client.ClientCredentials.UserName.Password
      = "pass";</code></p>
  
  <p>I believe the certificates are set up correctly (all using 'localhost'), however I receive the following exception when calling the service:</p>
  
  <blockquote>
    <p>System.ServiceModel.FaultException: ID3242: The security token could not be authenticated or authorized.</p>
  </blockquote>
  
  <p>Whatever I try seems to fail.  Is what I am describing even possible?  Does the service client also pass the client credentials through to the STS, or am I completely misunderstanding what is happening here?</p>
  
  <p>This stackoverflow question is similar, however I have checked the audience URL and it seems ok. <a href="https://stackoverflow.com/questions/5223018/wif-sts-id3242-the-security-token-could-not-be-authenticated-or-authorized">WIF STS ID3242</a></p>
  
  <p>Has anyone got any advice on how I can achieve custom authentication when using a STS?</p>