title: Pass SAML token into web api call
body: <p>I have a web application and web api services that authenticate through ADFS.  They are contained in the same IIS application, and the web app makes calls back to the web api services without a problem.</p>
  
  <p>I'm now trying to call the same services from a different application, but am having trouble passing the token.  I am able to authenticate and retrieve a SAML token with the following code:</p>
  
  <pre><code>var stsEndpoint = "https://MyAdfsServer/adfs/services/trust/13/UsernameMixed";
  var reliantPartyUri = "https://MyDomain/AppRoot/";
  
  var factory = new Microsoft.IdentityModel.Protocols.WSTrust.WSTrustChannelFactory(
              new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
              new EndpointAddress(stsEndpoint));
  
  factory.TrustVersion = System.ServiceModel.Security.TrustVersion.WSTrust13;
  
  // Username and Password here...
  factory.Credentials.UserName.UserName = @"Domain\UserName";
  factory.Credentials.UserName.Password = "Password";
  
  var rst = new RequestSecurityToken
      {
          RequestType = RequestTypes.Issue,
          AppliesTo = new EndpointAddress(reliantPartyUri),
          KeyType = KeyTypes.Bearer,
      };
  
  var channel = factory.CreateChannel();
  var token = channel.Issue(rst) as GenericXmlSecurityToken;
  
  var saml = token.TokenXml.OuterXml;
  </code></pre>
  
  <p>However, I'm not sure how to pass the saml in to the web api call.  I've tried this:</p>
  
  <pre><code>using (var handler = new HttpClientHandler() 
      { 
          ClientCertificateOptions = ClientCertificateOption.Automatic,
          AllowAutoRedirect = false
      })
  {
      using (var client = new HttpClient(handler))
      {
          client.BaseAddress = new Uri("https://MyDomain/AppRoot/api/");
  
          client.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue("SAML", saml);
  
          HttpResponseMessage response = client.GetAsync("MyService/Get/").Result;
  
          // Get the results...
          var result = response.Content.ReadAsStringAsync().Result;
          var status = response.StatusCode;
      }
  }
  </code></pre>
  
  <p>This is returning a status code of 302 and trying to redirect me to the ADFS server for authentication.  Is there another way to pass the SAML token to the web api service?</p>