title: Implementing WIF ActAs Scenario: The identity check failed for the outgoing message
body: <p>So I'm trying to consume a WCF service from a website and pass the IClaimsIdentity the site got from an STS through to the service.</p>
  
  <p>When I try to invoke a service method through an ActAs channel, I get the following error on the client (looking at trace logs, it never gets to the service, and the STS sends through all tokens correctly):</p>
  
  <blockquote>
    <p>The identity check failed for the outgoing message. The expected
    identity is
    'identity(http://schemas.xmlsoap.org/ws/2005/05/identity/right/possessproperty:
    <a href="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprint" rel="nofollow">http://schemas.xmlsoap.org/ws/2005/05/identity/claims/thumbprint</a>)' for
    the 'http://localhost/MyWCFHost/MyService.svc' target endpoint.</p>
  </blockquote>
  
  <p>I've got a custom IssuedTokenForCertificate binding and all the certificates are OK as far as I can see, it should work, but no dice. I'd appreciate another pair of eyes looking over my config and helping:</p>
  
  <p>Consuming Web Site config:</p>
  
  <pre><code>  &lt;system.serviceModel&gt;
      &lt;bindings&gt;
        &lt;customBinding&gt;
          &lt;binding name="CustomBinding_IMyService"&gt;
            &lt;security defaultAlgorithmSuite="Default" authenticationMode="IssuedTokenForCertificate"
              requireDerivedKeys="true" includeTimestamp="true" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"
              requireSignatureConfirmation="true"&gt;
              &lt;issuedTokenParameters tokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"&gt;
                &lt;additionalRequestParameters&gt;
                  &lt;trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;
                    &lt;trust:TokenType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1&lt;/trust:TokenType&gt;
                    &lt;trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey&lt;/trust:KeyType&gt;
                  &lt;/trust:SecondaryParameters&gt;
                &lt;/additionalRequestParameters&gt;
                &lt;issuer address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc"
                  binding="ws2007HttpBinding" bindingConfiguration="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc"&gt;
                &lt;/issuer&gt;
                &lt;issuerMetadata address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc/mex" /&gt;
              &lt;/issuedTokenParameters&gt;
              &lt;localClientSettings detectReplays="true" /&gt;
              &lt;localServiceSettings detectReplays="true" /&gt;
            &lt;/security&gt;
            &lt;textMessageEncoding /&gt;
            &lt;httpTransport /&gt;
          &lt;/binding&gt;
        &lt;/customBinding&gt;
        &lt;ws2007HttpBinding&gt;
          &lt;binding name="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc"&gt;
            &lt;security&gt;
              &lt;message establishSecurityContext="false" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/ws2007HttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
        &lt;endpoint address="http://localhost/MyWCFHost/MyService.svc" binding="customBinding"
          bindingConfiguration="CustomBinding_IMyService" contract="MyService.IMyService"
          name="CustomBinding_IMyService"&gt;
          &lt;identity&gt;
            &lt;!--&lt;certificate encodedValue="AwAAAAEAAAAUAAAAV2ILlfzl9NIHEiGv1rUCSitq8I0gAAAAAQAAAP8BAAAwggH7MIIBaKADAgECAhBTTBmG1HyUkEDVFmVUxfDLMAkGBSsOAwIdBQAwFTETMBEGA1UEAxMKRXRhbmEgUm9vdDAeFw0xMjA5MjExMjE2MDRaFw0zOTEyMzEyMzU5NTlaMB8xHTAbBgNVBAMTFEV0YW5hIFNUUyBFbmNyeXB0aW9uMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC0lbzr1b1aNiXGhwKMTO58QbLbbKoUtTRkA4egMlmip1Vm46BnscWAMvXA5kyzuqK6Cw/5bel15i0pZXR4kjByKbSr65V0/ODGrkUHaYb5vT8RzCczYcgzJmPGWawMYYJT8PXLXHkFmZZGXFZhiUBzyNMWh8YH16I/wFtUgmaBAQIDAQABo0owSDBGBgNVHQEEPzA9gBAV68U+Vhoc0Nu9qPJXfJSRoRcwFTETMBEGA1UEAxMKRXRhbmEgUm9vdIIQgnOTDbZVCaJFTK8PPAGynTAJBgUrDgMCHQUAA4GBACHLr32oqkFjKGN/fqk2VnsNNIs9niHQ4Q6UbJ252YWf4wFIz9Ho/+ZdFxC4tSHxa/IMH0kzYpRL5p61Zd8/QeryWCStqvoNPwyapaY3g0Pkm6dy6NJ82kX5eJxLjdJp8MVadPJs4VA7Smf+e9lMMoONAGP07AvzAVhtiYK2yMmH" /&gt;--&gt;
            &lt;certificateReference findValue="57620B95FCE5F4D2071221AFD6B5024A2B6AF08D" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" /&gt;
          &lt;/identity&gt;
        &lt;/endpoint&gt;
      &lt;/client&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>WCF Service config:</p>
  
  <pre><code>  &lt;system.serviceModel&gt;
      &lt;diagnostics&gt;
        &lt;messageLogging logMalformedMessages="true" logMessagesAtTransportLevel="true" /&gt;
      &lt;/diagnostics&gt;
      &lt;services&gt;
        &lt;service name="RPWCFApp.MyService" behaviorConfiguration="MyServiceBehaviour"&gt;
          &lt;endpoint address="" binding="customBinding" bindingConfiguration="CustomBindingConfiguration_IssuedTokenOverTransport" contract="RPWCFApp.IMyService" /&gt;
          &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" /&gt;
        &lt;/service&gt;
      &lt;/services&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="MyServiceBehaviour"&gt;
            &lt;federatedServiceHostConfiguration /&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="false" /&gt;
            &lt;serviceCredentials&gt;
              &lt;serviceCertificate findValue="81A5DB3796F48B00FAC37CE67D7D8CA43078B996" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" /&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
      &lt;extensions&gt;
        &lt;behaviorExtensions&gt;
          &lt;add name="federatedServiceHostConfiguration" type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /&gt;
        &lt;/behaviorExtensions&gt;
      &lt;/extensions&gt;
  
      &lt;bindings&gt;
        &lt;customBinding&gt;
          &lt;binding name="CustomBindingConfiguration_IssuedTokenOverTransport"&gt;
            &lt;security authenticationMode="IssuedTokenForCertificate" messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"&gt;
              &lt;issuedTokenParameters keyType="SymmetricKey" tokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1"&gt;
                &lt;issuer address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc" binding="ws2007HttpBinding" bindingConfiguration="IssuedTokenBinding" /&gt;
                &lt;issuerMetadata address="http://localhost/MyCompany.SecurityTokenService/ActAsIssuer.svc/mex" /&gt;
              &lt;/issuedTokenParameters&gt;
            &lt;/security&gt;
            &lt;textMessageEncoding /&gt;
            &lt;httpTransport /&gt;
          &lt;/binding&gt;
        &lt;/customBinding&gt;
        &lt;ws2007HttpBinding&gt;
          &lt;binding name="IssuedTokenBinding"&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;message clientCredentialType="Windows" establishSecurityContext="false" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/ws2007HttpBinding&gt;
      &lt;/bindings&gt;
    &lt;/system.serviceModel&gt;
  </code></pre>