title: SecurityNegotiationException - Retrieving token from web service
body: <p>I'm attempting to move from WIF 3.5 and onto WIF 4.5. However, the conversion is proving to be more difficult than I anticipated. The questions will correspond to the comments in the code.</p>
  <p>Full error message:</p>
  <blockquote>
  <p>System.Web.Services.Protocols.SoapException: 'System.Web.Services.Protocols.SoapException: Authentication Failed ---&gt;</p>
  <p>System.ServiceModel.Security.SecurityNegotiationException: Secure
  channel cannot be opened because security negotiation with the remote
  endpoint has failed.  This may be due to absent or incorrectly
  specified EndpointIdentity in the EndpointAddress used to create the
  channel.  Please verify the EndpointIdentity specified or implied by
  the EndpointAddress correctly identifies the remote endpoint.</p>
  <p>Secure channel cannot be opened because security negotiation with the
  remote endpoint has failed.  This may be due to absent or incorrectly
  specified EndpointIdentity in the EndpointAddress used to create the
  channel.  Please verify the EndpointIdentity specified or implied by
  the EndpointAddress correctly identifies the remote endpoint.</p>
  </blockquote>
  <p>#1. Which username/password combination is needed and which is not?</p>
  <p>#2. This is where SecurityNegotiationException is thrown. What am I missing exactly?</p>
  <p>So, am I way off or is it something simple I'm missing? Do I need to entirely rewrite how the <code>WSTrustChannelFactory</code> is being created?</p>
  <p>Code:</p>
  <pre><code>public string GetToken(string url, string domain, string realm, string username, string password)
  {
      string rp = realm;
      string token = &quot;&quot;;
  
      WSTrustChannelFactory trustChannelFactory = new WSTrustChannelFactory
      (
          new WSHttpBinding(SecurityMode.TransportWithMessageCredential),
          new EndpointAddress(new Uri(url))
      );
          
      trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;
      trustChannelFactory.Credentials.Windows.ClientCredential.Domain = domain;
      trustChannelFactory.Credentials.Windows.ClientCredential.UserName = username; // #1; not sure which pair is needed?
      trustChannelFactory.Credentials.Windows.ClientCredential.Password = password;
  
      trustChannelFactory.Credentials.UserName.Password = password;
      trustChannelFactory.Credentials.UserName.UserName = username;
  
      ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
  
      try
      {
          RequestSecurityToken rst = new RequestSecurityToken(RequestTypes.Issue, KeyTypes.Bearer);
          rst.AppliesTo = new EndpointReference(rp);
          rst.TokenType = SecurityTokenTypes.Saml;
  
          WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();
          GenericXmlSecurityToken token = channel.Issue(rst) as GenericXmlSecurityToken; // #2; Exception thrown here
          token = token.TokenXml.OuterXml;
      }
      catch (SecurityNegotiationException e)
      {
          LogError(&quot;Authentication Failed&quot;, e);
      }
      catch (TimeoutException e)
      {
          LogError(&quot;Unable to authenticate&quot;, e);
      }
      catch (CommunicationException e)
      {
          LogError(&quot;Communication exception&quot;, e);
      }
      catch (Exception e)
      {
          LogError(&quot;Unknown exception&quot;, e);
      }
      return token;
  }
  </code></pre>