title: WCF SAML 1.1 Client Issue
body: <p>Here is the scenario:</p>
  
  <p>1) WCF client calls STS requesting a SAML token via a  RST/Issue request</p>
  
  <p>2) STS responds with RSTRC/IssueFinal placing the SAML token into the response header</p>
  
  <p>3) WCF client picks up the SAML token an makes call to business web service</p>
  
  <p>STS and web service are hosted in a Java-based environment. 1) and 2) work fine, that is, I can see the STS responding in the expected manner with SOAP header and body correctly set.</p>
  
  <p>Now, the problem is that after receiving the response from the STS the WCF client sends a request for a security context token to the business web service which of course fails and I don't know how and why.</p>
  
  <p>This is my app.config for client:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
  &lt;system.serviceModel&gt;
  &lt;bindings&gt;
  &lt;wsFederationHttpBinding&gt;
  &lt;binding name="RegistryServiceBinding"&gt;
    &lt;security mode="TransportWithMessageCredential"&gt;
      &lt;message issuedTokenType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv1.1"
        negotiateServiceCredential="False" establishSecurityContext="false"&gt;
        &lt;issuer address="https://my-sts-ip/idp-ws/services/BasicSAMLIssuer"
        binding="customBinding" bindingConfiguration="STSBinding" /&gt;
      &lt;/message&gt;
    &lt;/security&gt;
  &lt;/binding&gt;
  &lt;/wsFederationHttpBinding&gt;
  
  &lt;customBinding&gt;
  &lt;binding name="STSBinding"&gt;
    &lt;security allowInsecureTransport="False"
      authenticationMode="UserNameOverTransport"
      requireSignatureConfirmation="false"
      messageSecurityVersion="WSSecurity11WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10"&gt;
    &lt;/security&gt;          
    &lt;textMessageEncoding messageVersion="Soap12WSAddressing10" /&gt;
    &lt;httpsTransport/&gt;
  &lt;/binding&gt;    
  &lt;/customBinding&gt;
  &lt;/bindings&gt;
  
  &lt;client&gt;
    &lt;endpoint address="https://my-ws-ip/soap/RegistryStoredQuery"
    binding="wsFederationHttpBinding" bindingConfiguration="RegistryServiceBinding"
    contract="IXDSRegistry" name="RegistrySTS" /&gt;
  &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  &lt;startup&gt;
    &lt;supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.0,Profile=Client" /&gt;
  &lt;/startup&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>And this is what the WCF client sends after getting the SAML token from the STS (abbreviated):</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope"
              xmlns:a="http://www.w3.org/2005/08/addressing" 
              xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
  &lt;s:Header&gt;
  &lt;a:Action
    s:mustUnderstand="1"&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/RST/SCT&lt;/a:Action&gt;
  &lt;a:MessageID&gt;urn:uuid:fecde50b-a3bd-40f1-ae5b-662a3aa9bf80&lt;/a:MessageID&gt;
  &lt;ActivityId CorrelationId="cec77c8d-1d09-4e34-9c5a-dbf5bb219ba8"
    xmlns="http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics"&gt;bfce2552-393d-43d0-8722-0c16ae22bba4&lt;/ActivityId&gt;
  &lt;a:ReplyTo&gt;
    &lt;a:Address&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
  &lt;/a:ReplyTo&gt;
  &lt;a:To s:mustUnderstand="1"&gt;https://10.11.71.151/soap/RegistryStoredQuery&lt;/a:To&gt;
  &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
  &lt;u:Timestamp u:Id="_0"&gt;
    &lt;u:Created&gt;2011-10-28T07:27:50.097Z&lt;/u:Created&gt;
    &lt;u:Expires&gt;2011-10-28T07:32:50.097Z&lt;/u:Expires&gt;
  &lt;/u:Timestamp&gt;
  &lt;Assertion&gt; .... &lt;/Assertion&gt;
  
  &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#"&gt;
  ...
  &lt;/Signature&gt;
  &lt;/o:Security&gt;
  &lt;/s:Header&gt;
  &lt;s:Body&gt;
    &lt;t:RequestSecurityToken xmlns:t="http://schemas.xmlsoap.org/ws/2005/02/trust"&gt;
    &lt;t:TokenType&gt;http://schemas.xmlsoap.org/ws/2005/02/sc/sct&lt;/t:TokenType&gt;
    &lt;t:RequestType&gt;http://schemas.xmlsoap.org/ws/2005/02/trust/Issue&lt;/t:RequestType&gt;
    &lt;t:Entropy&gt;
      &lt;t:BinarySecret u:Id="uuid-d1ed3eb6-d7f6-4d2b-ab7e-a6c60d899bad-3" Type="http://schemas.xmlsoap.org/ws/2005/02/trust/Nonce"&gt;iRqJf4/sY1yiu7Vh1eTGeAWJi7o0gxnhS6A2YvJQ6kI=&lt;/t:BinarySecret&gt;
    &lt;/t:Entropy&gt;
  &lt;t:KeySize&gt;256&lt;/t:KeySize&gt;
  &lt;/t:RequestSecurityToken&gt;
  &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>Any ideas what could trigger this behaviour? </p>
  
  <p>Best Regards.</p>