title: Azure Bus, TokenProvider with ACS Service Identity, using password
body: <p>I am using the Azure Bus for messaging.  We are configuring ACS with proper security practice, i.e. with different relying parties representing different topics &amp; subscriptions.</p>
  
  <p>We are using ACS Service Identity to access the bus.  So far we were using a symmetric key but we are moving to use passwords with those identities.</p>
  
  <p>I am failing to find a way to setup a TokenProvider (to pass to a MessagingFactory) to authenticate my Service Identities.</p>
  
  <p>I've tried:</p>
  
  <pre><code>        var serviceUri = ServiceBusEnvironment.CreateServiceUri(
              "sb",
              serviceBusNamespace,
              string.Empty);
          var tokenProvider = TokenProvider.CreateOAuthTokenProvider(
              new[] { serviceUri },
              new NetworkCredential(serviceIdentityName, serviceIdentityPassword));
  </code></pre>
  
  <p>which throws, complaining about "timeout elapsed upon attempting to obtain a token while accessing '<a href="https://XYZ.servicebus.windows.net/" rel="nofollow">https://XYZ.servicebus.windows.net/</a>$STS/OAuth/'.".  I know that url isn't the endpoint for o-auth ; I don't know why it's trying to go there.</p>
  
  <p>So I've tried:</p>
  
  <pre><code>        var tokenProvider = TokenProvider.CreateOAuthTokenProvider(
              new[] { new Uri("https://XYZ-sb.accesscontrol.windows.net/v2/OAuth2-13") },
              new NetworkCredential(serviceIdentityName, serviceIdentityPassword));
  </code></pre>
  
  <p>which threw with "timeout elapsed upon attempting to obtain a token while accessing '<a href="https://XYZ-sb.accesscontrol.windows.net/v2/OAuth2-13/" rel="nofollow">https://XYZ-sb.accesscontrol.windows.net/v2/OAuth2-13/</a>$STS/OAuth/'."</p>
  
  <p>Again the url isn't good...</p>
  
  <p>So I changed tactic and tried:</p>
  
  <pre><code>        var tokenProvider = TokenProvider.CreateSharedSecretTokenProvider(
              serviceIdentityName,
              serviceIdentityPassword);
  </code></pre>
  
  <p>To receive the exception "The token provider was unable to provide a security token while accessing '<a href="https://XYZ-sb.accesscontrol.windows.net/WRAPv0.9/" rel="nofollow">https://XYZ-sb.accesscontrol.windows.net/WRAPv0.9/</a>'"</p>
  
  <p>So...  What is the right incantation to authenticate a service identity using a password?</p>