title: How do I configure WCF to use a custom Realm in URN format with Azure ACS?
body: <p>How do I make my WCF client authenticate using the ACS to my internally hosted WCF service?  The issue revolves around setting a custom Realm (which I can't figure out how to set.)</p>
  
  <p>My ACS is configured similar to <a href="http://acs.codeplex.com/wikipage?title=WCF%20Certificate%20Authentication&amp;referringTitle=Samples" rel="nofollow noreferrer">the ACS Samples</a> however the "Realm" is defined as shown below. </p>
  
  <p><em>Excerpt from Azure ACS Configuration page</em></p>
  
  <hr>
  
  <p><img src="https://i.stack.imgur.com/btUtk.png" alt="realm definition"></p>
  
  <hr>
  
  <p><strong>Client Side Code</strong></p>
  
  <pre><code>      EndpointAddress serviceEndpointAddress = new EndpointAddress( new Uri( "http://localhost:7000/Service/Default.aspx"),  
                                                                        EndpointIdentity.CreateDnsIdentity( GetServiceCertificateSubjectName() ),
                                                                        new AddressHeaderCollection() );
  
          ChannelFactory&lt;IStringService&gt; stringServiceFactory = new ChannelFactory&lt;IStringService&gt;(Bindings.CreateServiceBinding("https://agent7.accesscontrol.appfabriclabs.com/v2/wstrust/13/certificate"), serviceEndpointAddress );
  
          // Set the service credentials.
          stringServiceFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
          stringServiceFactory.Credentials.ServiceCertificate.DefaultCertificate = GetServiceCertificate();
  
          // Set the client credentials.
          stringServiceFactory.Credentials.ClientCertificate.Certificate = GetClientCertificateWithPrivateKey();
  </code></pre>
  
  <p><strong>Server Side Code</strong></p>
  
  <pre><code> string acsCertificateEndpoint = String.Format( "https://{0}.{1}/v2/wstrust/13/certificate", AccessControlNamespace, AccessControlHostName );
  
          ServiceHost rpHost = new ServiceHost( typeof( StringService ) );
  
          rpHost.Credentials.ServiceCertificate.Certificate = GetServiceCertificateWithPrivateKey();
  
          rpHost.AddServiceEndpoint( typeof( IStringService ),
                                     Bindings.CreateServiceBinding( acsCertificateEndpoint ),
                                     "http://localhost:7000/Service/Default.aspx"
                                     );
  
          //
          // This must be called after all WCF settings are set on the service host so the
          // Windows Identity Foundation token handlers can pick up the relevant settings.
          //
          ServiceConfiguration serviceConfiguration = new ServiceConfiguration();
          serviceConfiguration.CertificateValidationMode = X509CertificateValidationMode.None;
  
          // Accept ACS signing certificate as Issuer.
          serviceConfiguration.IssuerNameRegistry = new X509IssuerNameRegistry( GetAcsSigningCertificate().SubjectName.Name );
  
          // Add the SAML 2.0 token handler.
          serviceConfiguration.SecurityTokenHandlers.AddOrReplace( new Saml2SecurityTokenHandler() );
  
          // Add the address of this service to the allowed audiences.
          serviceConfiguration.SecurityTokenHandlers.Configuration.AudienceRestriction.AllowedAudienceUris.Add( new Uri( "urn:federation:customer:222:agent:11") );
  
          FederatedServiceCredentials.ConfigureServiceHost( rpHost, serviceConfiguration );
  
          return rpHost;
  </code></pre>
  
  <p>... where <code>urn:federation:customer:222:agent:11</code> is the Relying party ID</p>
  
  <p>... and <code>http://localhost:7000/Service/Default.aspx</code> is the location I want the above WCF / WIF client to bind to once the ACS authentication is made. </p>
  
  <p><strong>Question</strong></p>
  
  <p>How do I edit the code above so that the client and server will both operate against a certain port (localhost:700) and also with a realm of urn:federation:customer:222:agent:11</p>
  
  <p>I think I have the server code correct; however how do I set <code>AudienceRestriction</code> on the client?</p>