title: Problems using net.tcp for STS
body: <p>I keep on getting the following error when I try to access a WCF endpoint with an STS reference...</p>
  
  <blockquote>
    <p>Incoming policy failed validation.  No valid claim elements were found in the policy XML.</p>
  </blockquote>
  
  <p>Below are the web configs for the STS and WCF web service....</p>
  
  <p>STS Web Config...</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  
  &lt;configuration&gt;
  &lt;appSettings&gt;
  &lt;add key="IssuerName" value="ActiveSTS"/&gt;
  &lt;add key="SigningCertificateName" value="CN=STSTestCert"/&gt;
  &lt;add key="EncryptingCertificateName" value="CN=DefaultApplicationCertificate"/&gt;
  &lt;/appSettings&gt;
  
  &lt;connectionStrings /&gt;
  
  &lt;location path="FederationMetadata"&gt;
  &lt;system.web&gt;
    &lt;authorization&gt;
      &lt;allow users="*"/&gt;
    &lt;/authorization&gt;
  &lt;/system.web&gt;
  &lt;/location&gt;
  
  &lt;system.web&gt;
  &lt;compilation debug="true" targetFramework="4.0"&gt;
    &lt;assemblies&gt;
      &lt;add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;/assemblies&gt;
  &lt;/compilation&gt;
  &lt;authentication mode="None"&gt; &lt;/authentication&gt;
  
  &lt;pages&gt;
    &lt;controls&gt;
      &lt;add tagPrefix="asp" namespace="System.Web.UI" assembly="System.Web.Extensions,     Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;/controls&gt;
  &lt;/pages&gt;
  &lt;/system.web&gt;
  
  &lt;system.web.extensions&gt;
  &lt;scripting&gt;
    &lt;webServices /&gt;
  &lt;/scripting&gt;
  &lt;/system.web.extensions&gt;
  
  &lt;system.serviceModel&gt;
  &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" /&gt;
  &lt;diagnostics&gt;
    &lt;messageLogging
  logMalformedMessages="true"
  logMessagesAtServiceLevel="true"
  logEntireMessage="true"
  logMessagesAtTransportLevel="true"/&gt;
  &lt;/diagnostics&gt;
  
  &lt;services &gt;
    &lt;service behaviorConfiguration="ServiceBehavior"
      name="Samples.Security.STS.SecurityTokenService"&gt;
      &lt;!-- Mutual X509 Endpoint --&gt;
  
      &lt;endpoint
   binding="customBinding"
   address=""
   bindingConfiguration="MutualCertificateBinding"
   contract="Samples.Security.STS.ISecurityTokenService"&gt;
      &lt;/endpoint&gt;
  
      &lt;host&gt;
        &lt;baseAddresses&gt;
          &lt;add baseAddress="net.tcp://localhost:8100/sts/"  /&gt;
        &lt;/baseAddresses&gt;
      &lt;/host&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  
  &lt;bindings&gt;
    &lt;customBinding&gt;
      &lt;binding name="MutualCertificateBinding"&gt;
        &lt;security allowInsecureTransport="true" securityHeaderLayout="Lax" enableUnsecuredResponse="true" &gt;
        &lt;/security&gt;
        &lt;binaryMessageEncoding/&gt;
        &lt;tcpTransport /&gt;
      &lt;/binding&gt;
    &lt;/customBinding&gt;
  &lt;/bindings&gt;
  
  
  &lt;behaviors &gt;
    &lt;serviceBehaviors&gt;
  
      &lt;behavior name="ServiceBehavior"&gt;
  
        &lt;serviceMetadata httpGetEnabled="True" httpGetUrl="http://localhost:8831/sts/" /&gt;
  
  
        &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  
  &lt;/system.serviceModel&gt; 
  
  &lt;/configuration&gt;
  </code></pre>
  
  <p>WCF Web Config...</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
    &lt;configSections&gt;
      &lt;section name="microsoft.identityModel"     type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection,     Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"     /&gt;
    &lt;/configSections&gt;
        &lt;location path="FederationMetadata"&gt;
          &lt;system.web&gt;
            &lt;authorization&gt;
              &lt;allow users="*" /&gt;
            &lt;/authorization&gt;
          &lt;/system.web&gt;
        &lt;/location&gt;
        &lt;system.web&gt;
          &lt;compilation debug="true" targetFramework="4.0"&gt;
            &lt;assemblies&gt;
              &lt;add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral,     PublicKeyToken=31BF3856AD364E35" /&gt;
            &lt;/assemblies&gt;
          &lt;/compilation&gt;
        &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior&gt;
            &lt;federatedServiceHostConfiguration /&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;          
            &lt;serviceCredentials&gt;
              &lt;serviceCertificate findValue="A3A4D95F1E40D274541EF53D5C9B672F00F41B36" storeLocation="LocalMachine" storeName="My" x509FindType="FindByThumbprint" /&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="false" multipleSiteBindingsEnabled="true" /&gt;
      &lt;extensions&gt;
        &lt;behaviorExtensions&gt;
          &lt;add name="federatedServiceHostConfiguration" type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /&gt;
        &lt;/behaviorExtensions&gt;
      &lt;/extensions&gt;
      &lt;protocolMapping&gt;
        &lt;add scheme="http" binding="ws2007FederationHttpBinding" /&gt;
      &lt;/protocolMapping&gt;
      &lt;bindings&gt;
        &lt;customBinding&gt;
          &lt;binding&gt;
            &lt;security allowInsecureTransport="true" securityHeaderLayout="Lax" enableUnsecuredResponse="true"&gt;
            &lt;/security&gt;
            &lt;binaryMessageEncoding /&gt;
            &lt;tcpTransport /&gt;
          &lt;/binding&gt;
        &lt;/customBinding&gt;
        &lt;ws2007FederationHttpBinding&gt;
          &lt;binding&gt;
            &lt;security mode="Message"&gt;
              &lt;message&gt;
                &lt;issuerMetadata address="http://localhost:11558/JonsFoodInformationService_STS/Service.svc/mex" /&gt;
                &lt;claimTypeRequirements&gt;
                  &lt;add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="true" /&gt;
                  &lt;add claimType="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" isOptional="true" /&gt;
  
                &lt;/claimTypeRequirements&gt;
              &lt;/message&gt;
            &lt;/security&gt;
         &lt;/binding&gt;
        &lt;/ws2007FederationHttpBinding&gt;
      &lt;/bindings&gt;
    &lt;/system.serviceModel&gt;
    &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true" /&gt;
    &lt;/system.webServer&gt;
    &lt;microsoft.identityModel&gt;
      &lt;service&gt;
        &lt;audienceUris&gt;
          &lt;add value="http://localhost:15796/FoodOfTheMonthService.svc" /&gt;
        &lt;/audienceUris&gt;
        &lt;issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"&gt;
          &lt;trustedIssuers&gt;
            &lt;add thumbprint="2ABE4F1A98C12363F3A654E76F211F62895DBE65" name="net.tcp://localhost:8000/sts/Service.svc" /&gt;
          &lt;/trustedIssuers&gt;
        &lt;/issuerNameRegistry&gt;
      &lt;/service&gt;
    &lt;/microsoft.identityModel&gt;
    &lt;appSettings&gt;
      &lt;add key="FederationMetadataLocation" value="C:\JonsAttempt - Try 5 WOrked - Copy\JonsFoodInformationService_STS\FederationMetadata\2007-06\FederationMetadata.xml" /&gt;
    &lt;/appSettings&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Any help is very much appreciated!</p>