title: Delegating secure tokens from one relying party to another
body: <p>I have a WCF service that is a relying party for a custom STS, built using WIF.  My STS issues holder-of-key tokens to my client application.  I have created a new 'backend' WCF service, that I need to call from the existing 'frontend' service.  <strong>How can I use the incoming secure token in the frontend service to call the backend service, without retrieving a new one from the STS?</strong></p>
  
  <p><img src="https://i.stack.imgur.com/HpYL0.jpg" alt="enter image description here"></p>
  
  <p>So far, in my frontend service, I have no problem accessing the incoming SamlSecurityToken using a custom Saml11SecurityTokenHandler.</p>
  
  <p>After that, I tried two different ways to attach the out of band token to a service call on my target backend service:</p>
  
  <ol>
  <li>Create a custom IssuedSecurityTokenProvider</li>
  <li>Use ChannelFactoryOperations.CreateChannelWithIssuedToken</li>
  </ol>
  
  <p>However, both of these attempts result in errors.  From what I can tell, it seems to be the same dead end, - they do not accept the signed SamlSecurityToken.  It seems that even though both of these methods accept the base SecurityToken class, they both only work if given a GenericXmlSecurityToken instance, instead of a SamlSecurityToken.</p>
  
  <p>Update:
  Here is a <a href="https://gist.github.com/dotnetdan/e638c561c7fb606d32dc" rel="nofollow noreferrer">code sample</a> and the <a href="https://gist.github.com/dotnetdan/b1baa2ddddecb6d11029" rel="nofollow noreferrer">exception details</a> for bullet #1</p>
  
  <p>Update 2:
  After doing some more research, the closest thing I can find was an article about using <a href="http://msdn.microsoft.com/en-us/library/ee517269.aspx" rel="nofollow noreferrer">Identity Delegation</a> for WIF/ADFS which basically just uses ActAs tokens, in which the front end service would issue a request to the STS using the token it recieved from the client application.  This would require an update to our custom STS, which we're hoping not to do at this time.  I'm starting to wonder if the approach that I've illustrated in my diagram is even valid for WIF or WS-Trust?</p>