title: IdentityServer and ADFS
body: <p>I'm trying to setup IdentityServer to use ADFS for authentication. The flow will be:</p>
  
  <p><strong><em>User -> Custom app -> IS -> ADFS</em></strong></p>
  
  <p>I've setup almost everything, but I'm stuck at the communication between IS and ADFS. The user seems to login successfully in ADFS, but I get an error:</p>
  
  <p><strong>ID4037: The key needed to verify the signature could not be resolved from the following security key identifier 'SecurityKeyIdentifier</strong></p>
  
  <p>when I get back to IS.</p>
  
  <p>It's obvious that there's an issue with the token signing certificates in one side or the other. I've tried unsuccessfully to find some documentation explaining the relation between different certificates.</p>
  
  <p>Right now I have a self signed certificate in IS that is signing tokens (set up using SigningCertificate property of IdentityServerOptions) and I have a AD certificate configured in ADFS to sign tokens.</p>
  
  <p>Is there any guide or recommendation on how to properly do it? Should it be the same in both or should I configure something else to make it work?</p>
  
  <p><strong>EDIT</strong>
  With Fiddler I can see that everything inside ADFS runs fine and the error is when the results are posted to IdentityServer. The XML posted in wresult param is:</p>
  
  <pre><code>&lt;t:RequestSecurityTokenResponse xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"&gt;
    &lt;t:Lifetime&gt;
      &lt;wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2017-06-20T12:25:31.148Z&lt;/wsu:Created&gt;
      &lt;wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2017-06-20T13:25:31.148Z&lt;/wsu:Expires&gt;
    &lt;/t:Lifetime&gt;
    &lt;wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"&gt;
      &lt;wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
        &lt;wsa:Address&gt;urn:identityServer&lt;/wsa:Address&gt;
      &lt;/wsa:EndpointReference&gt;
    &lt;/wsp:AppliesTo&gt;
    &lt;t:RequestedSecurityToken&gt;
      &lt;saml:Assertion MajorVersion="1" MinorVersion="1" AssertionID="_fd1a14cd-4d18-407b-97d4-9f9dfcacd29a" Issuer="http://ssosrv.mydomain.com/adfs/services/trust" IssueInstant="2017-06-20T12:25:31.148Z" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"&gt;
        &lt;saml:Conditions NotBefore="2017-06-20T12:25:31.148Z" NotOnOrAfter="2017-06-20T13:25:31.148Z"&gt;
          &lt;saml:AudienceRestrictionCondition&gt;
            &lt;saml:Audience&gt;urn:identityServer&lt;/saml:Audience&gt;
          &lt;/saml:AudienceRestrictionCondition&gt;
        &lt;/saml:Conditions&gt;
        &lt;saml:AttributeStatement&gt;
          &lt;saml:Subject&gt;
            &lt;saml:NameIdentifier&gt;user@mydomain.com&lt;/saml:NameIdentifier&gt;
            &lt;saml:SubjectConfirmation&gt;
              &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/saml:ConfirmationMethod&gt;
            &lt;/saml:SubjectConfirmation&gt;
          &lt;/saml:Subject&gt;
          &lt;saml:Attribute AttributeName="emailaddress" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims"&gt;
            &lt;saml:AttributeValue&gt;name.surname@mydomain.tv&lt;/saml:AttributeValue&gt;
          &lt;/saml:Attribute&gt;
          &lt;saml:Attribute AttributeName="name" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims"&gt;
            &lt;saml:AttributeValue&gt;Name Surname&lt;/saml:AttributeValue&gt;
          &lt;/saml:Attribute&gt;
          &lt;saml:Attribute AttributeName="upn" AttributeNamespace="http://schemas.xmlsoap.org/ws/2005/05/identity/claims"&gt;
            &lt;saml:AttributeValue&gt;user@mydomain.com&lt;/saml:AttributeValue&gt;
          &lt;/saml:Attribute&gt;
        &lt;/saml:AttributeStatement&gt;
        &lt;saml:AuthenticationStatement AuthenticationMethod="urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport" AuthenticationInstant="2017-06-20T12:25:31.039Z"&gt;
          &lt;saml:Subject&gt;
            &lt;saml:NameIdentifier&gt;user@mydomain.com&lt;/saml:NameIdentifier&gt;
            &lt;saml:SubjectConfirmation&gt;
              &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/saml:ConfirmationMethod&gt;
            &lt;/saml:SubjectConfirmation&gt;
          &lt;/saml:Subject&gt;
        &lt;/saml:AuthenticationStatement&gt;
        &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
          &lt;ds:SignedInfo&gt;
            &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
            &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" /&gt;
            &lt;ds:Reference URI="#_fd1a14cd-4d18-407b-97d4-9f9dfcacd29a"&gt;
              &lt;ds:Transforms&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" /&gt;
                &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" /&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" /&gt;
              &lt;ds:DigestValue&gt;6CeXXXXXXXXXXXXXXXXXXXX=&lt;/ds:DigestValue&gt;
            &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;q9hJBFFFFFFFFFFFFFFFFFFFF==&lt;/ds:SignatureValue&gt;
          &lt;KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
            &lt;X509Data&gt;
              &lt;X509Certificate&gt;MIIFnzXXXXXXXXXXXXXXXXXXXX&lt;/X509Certificate&gt;
            &lt;/X509Data&gt;
          &lt;/KeyInfo&gt;
        &lt;/ds:Signature&gt;
      &lt;/saml:Assertion&gt;
    &lt;/t:RequestedSecurityToken&gt;
    &lt;t:TokenType&gt;urn:oasis:names:tc:SAML:1.0:assertion&lt;/t:TokenType&gt;
    &lt;t:RequestType&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/Issue&lt;/t:RequestType&gt;
    &lt;t:KeyType&gt;http://schemas.xmlsoap.org/ws/2005/05/identity/NoProofKey&lt;/t:KeyType&gt;
  &lt;/t:RequestSecurityTokenResponse&gt;
  </code></pre>
  
  <p>Thank you,
  Albert</p>