title: Azure - running an app in Azure using ADFS returns the following error: Exception message: ID4014: A SecurityTokenHandler is not
body: <p>I have my app built and deployed in Azure, utilizing ADFS for authentication.  When I access my app, it redirects me to the ADFS log-in page.  I log in, and then it redirects me back to my app, where I encounter the following exception: </p>
  
  <blockquote>
    <p>Exception information: 
        Exception type: SecurityTokenException 
        Exception message: ID4014: A SecurityTokenHandler is not registered to read security token ('BinarySecurityToken',
    '<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" rel="nofollow">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>').
    at System.IdentityModel.Services.TokenReceiver.ReadToken(String
    tokenXml, XmlDictionaryReaderQuotas readerQuotas,
    FederationConfiguration federationConfiguration)    at
    System.IdentityModel.Services.WSFederationAuthenticationModule.SignInWithResponseMessage(HttpRequestBase
    request)    at
    System.IdentityModel.Services.WSFederationAuthenticationModule.OnAuthenticateRequest(Object
    sender, EventArgs args)    at
    System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()
    at System.Web.HttpApplication.ExecuteStep(IExecutionStep step,
    Boolean&amp; completedSynchronously)</p>
  </blockquote>
  
  <p><strong>This is my first time dealing with ADFS and Azure - few questions:</strong> </p>
  
  <ol>
  <li>What part of my code would I need to modify to accommodate the
  Security Token requirement (assuming I need to)?  For example, when the user logs in through ADFS, and ADFS redirects the user back to my app, should my app "just work" at that point, and the Login link at the top of the page change to Logout?  I'm using MVC4.</li>
  <li>My company's ADFS server has its own log-in page.  Does this mean I
  can do away with the log-in functionality that comes out of the box with my Azure
  MVC app?</li>
  </ol>
  
  <p><strong>EDIT</strong>
  Here's the FederationMetadata.xml file with all sensitive data removed: <a href="http://mikemarks.net/FederationMetadata.xml" rel="nofollow">http://mikemarks.net/FederationMetadata.xml</a></p>
  
  <p><strong>EDIT</strong>
  Here's my <code>system.identityModel</code> and <code>system.identityModel.service</code> section of my web.config:</p>
  
  <pre><code>&lt;system.identityModel&gt;
    &lt;identityConfiguration&gt;
      &lt;audienceUris&gt;
        &lt;add value="https://conocopocazuremike.cloudapp.net/" /&gt;
      &lt;/audienceUris&gt;
      &lt;!--Commented by Identity and Access VS Package--&gt;
      &lt;!--&lt;issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"&gt;&lt;authority name="http://blah/adfs/services/trust"&gt;&lt;keys&gt;&lt;add thumbprint="blah" /&gt;&lt;/keys&gt;&lt;validIssuers&gt;&lt;add name="http://blah/adfs/services/trust" /&gt;&lt;/validIssuers&gt;&lt;/authority&gt;&lt;/issuerNameRegistry&gt;--&gt;
      &lt;!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.--&gt;
      &lt;certificateValidation certificateValidationMode="None" /&gt;
      &lt;!--Commented by Identity and Access VS Package--&gt;
      &lt;!--&lt;issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"&gt;&lt;authority name="http://blah/adfs/services/trust"&gt;&lt;keys&gt;&lt;add thumbprint="blah" /&gt;&lt;/keys&gt;&lt;validIssuers&gt;&lt;add name="http://blah/adfs/services/trust" /&gt;&lt;/validIssuers&gt;&lt;/authority&gt;&lt;/issuerNameRegistry&gt;--&gt;
      &lt;!--Commented by Identity and Access VS Package--&gt;
      &lt;!--&lt;issuerNameRegistry type="System.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"&gt;&lt;trustedIssuers&gt;&lt;add thumbprint="blah" name="http://blah/adfs/services/trust" /&gt;&lt;/trustedIssuers&gt;&lt;/issuerNameRegistry&gt;--&gt;
      &lt;issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"&gt;
        &lt;authority name="http://blah/adfs/services/trust"&gt;
          &lt;keys&gt;
            &lt;add thumbprint="blah" /&gt;
          &lt;/keys&gt;
          &lt;validIssuers&gt;
            &lt;add name="http://blah/adfs/services/trust" /&gt;
          &lt;/validIssuers&gt;
        &lt;/authority&gt;
      &lt;/issuerNameRegistry&gt;
    &lt;/identityConfiguration&gt;
  &lt;/system.identityModel&gt;
  &lt;system.identityModel.services&gt;
    &lt;federationConfiguration&gt;
      &lt;cookieHandler requireSsl="false" /&gt;
      &lt;wsFederation passiveRedirectEnabled="true" issuer="https://blah/adfs/ls/" realm="https://blah.cloudapp.net/" requireHttps="false" /&gt;
    &lt;/federationConfiguration&gt;
  &lt;/system.identityModel.services&gt;
  </code></pre>