title: windows authentication with ADFS on standalone application
body: <p>I have this Windows console application which is trying to perform windows authentication against ADFS. I'm already able to authenticate by using username/password but I don't want to do it this way since the user has already been authenticated in Windows.</p>
  
  <p>I have this code:</p>
  
  <pre><code>        //Setup the connection to ADFS
  
          const string adfsEndpoint = "https://iis.dev.lab/adfs/services/trust/13/windowsmixed";
  
          var factory = new WSTrustChannelFactory(new WindowsWSTrustBinding(SecurityMode.TransportWithMessageCredential), new EndpointAddress(adfsEndpoint))
          {
              TrustVersion = TrustVersion.WSTrust13
          };
  
          //Setup the request object 
          var rst = new RequestSecurityToken
          {
              RequestType = RequestTypes.Issue,
              KeyType = KeyTypes.Bearer,
              AppliesTo = new EndpointReference(relyingPartyId)
          };
  
          //Open a connection to ADFS and get a token for the logged in user
          var channel = factory.CreateChannel();
  
          var genericToken = channel.Issue(rst) as GenericXmlSecurityToken;
  </code></pre>
  
  <p>and when it tries to get the token I have this exception:</p>
  
  <blockquote>
    <p>Security Support Provider Interface (SSPI) authentication failed. The ser
    ver may not be running in an account with identity 'host/iis.dev.lab'. If the se
    rver is running in a service account (Network Service for example), specify the
    account's ServicePrincipalName as the identity in the EndpointAddress for the se
    rver. If the server is running in a user account, specify the account's UserPrin
    cipalName as the identity in the EndpointAddress for the server.</p>
  </blockquote>
  
  <p>The thing is:</p>
  
  <ul>
  <li>The user is already authenticated in <strong>dev.lab</strong> domain</li>
  <li>ADSF service is running under an admin user account in <strong>dev.lab</strong> domain</li>
  <li>In the error message I have <strong>iis.dev.lab</strong> domain for some reason and it may be the reason..</li>
  </ul>
  
  <p>Questions:</p>
  
  <ol>
  <li>Should I use this url ("../adfs/services/trust/13/<strong>windowsmixed</strong>")to perform this kind of authentication ? Or should I use <strong>kerberosmixed</strong> ? Can someone point out some documentation concerning the goal of each service available in ADFS?</li>
  <li>Is there a way to set the domain of the user before making the request? I've tried this <code>factory.Credentials.Windows.ClientCredential.Domain = "dev.lab";</code> but it didn't work out.</li>
  <li>Do I still need to define the credentials even if doing win auth? Like this for instance: <code>factory.Credentials.Windows.ClientCredential = CredentialCache.DefaultNetworkCredentials;</code> ?</li>
  </ol>
  
  <p>Any help is appreciated.</p>