title: How do you pass a (Claims) security Token to a WIF enabled WCF service?
body: <p>my escope :</p>
  
  <p>How do you pass a (Claims) security Token to a WIF enabled WCF service?</p>
  
  <p>Implement security asp mvc (ok)</p>
  
  <p>Implement security in wcf (not ok)</p>
  
  <p>Pass the token from client to wcf.(not ok)</p>
  
  <p>My code client </p>
  
  <pre><code>    using System.IdentityModel.Tokens;
      using System.Security.Claims;
      using System.ServiceModel;
      using System.ServiceModel.Security;
      using System.Web.Mvc;
      using Microsoft.IdentityModel.Protocols.WSTrust;
      using Nobre.Core.Helpers;
      using Wcf;
  
  
      namespace Mvc.Controllers
      {
          public class HomeController : Controller
          {
              [Authorize]
              public ActionResult Index()
              {
                  var identity = HttpContext.User.Identity as ClaimsIdentity;
                  var securityToken = WcfHelper.GetActAsToken(identity.BootstrapContext as BootstrapContext);
                  var serviceAddress = "https://estnbr363.nobre.local/Service1.svc";
                  var binding = new WSFederationHttpBinding();
  
                  binding.Security.Mode = WSFederationHttpSecurityMode.TransportWithMessageCredential;
                  binding.Security.Message.AlgorithmSuite = SecurityAlgorithmSuite.Basic256Rsa15;
                  binding.Security.Message.NegotiateServiceCredential = true;
                  binding.Security.Message.IssuedKeyType = SecurityKeyType.SymmetricKey;
                  binding.Security.Message.IssuedTokenType ="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#samlv1.1";
  
                  var factory = new ChannelFactory&lt;IService1&gt;(binding, serviceAddress);
                  factory.ConfigureChannelFactory();
                  factory.Credentials.SupportInteractive = false;
                  var channel = factory.CreateChannelActingAs(securityToken);  
  
                  return View( channel.GetData(1));
  
              }
          }
      }
  
  
      web config service         
  &lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
    &lt;configSections&gt;
      &lt;section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
    &lt;/configSections&gt;
    &lt;appSettings&gt;
      &lt;add key="ida:FederationMetadataLocation" value="https://nobre-security.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml" /&gt;
      &lt;add key="ida:Issuer" value="https://nobre-security.accesscontrol.windows.net/v2/wsfederation" /&gt;
      &lt;add key="ida:ProviderSelection" value="ACS" /&gt;
    &lt;/appSettings&gt;
    &lt;location path="FederationMetadata"&gt;
      &lt;system.web&gt;
        &lt;!--&lt;authorization&gt;
          &lt;allow users="*" /&gt;
        &lt;/authorization&gt;--&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;system.web&gt;
      &lt;!--&lt;authorization&gt;
        &lt;deny users="?" /&gt;
      &lt;/authorization&gt;--&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime targetFramework="4.5" /&gt;
    &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
      &lt;diagnostics&gt;
        &lt;messageLogging maxMessagesToLog="25000" logEntireMessage="true" logMessagesAtServiceLevel="false"  logMalformedMessages="true" logMessagesAtTransportLevel="true"&gt;
          &lt;filters&gt;
            &lt;clear/&gt;
          &lt;/filters&gt;
        &lt;/messageLogging&gt;
      &lt;/diagnostics&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior&gt;
            &lt;serviceMetadata httpsGetEnabled="true" /&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
            &lt;serviceCredentials useIdentityConfiguration="true" /&gt;
            &lt;serviceAuthorization principalPermissionMode="Always" /&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
      &lt;bindings&gt;
        &lt;ws2007FederationHttpBinding &gt;
          &lt;binding &gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;message  issuedKeyType="BearerKey" negotiateServiceCredential="true"&gt;
                &lt;issuerMetadata address="https://federation.nobre.net.br/adfs/services/trust/mex" /&gt;
              &lt;/message&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/ws2007FederationHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;services&gt;
        &lt;service name="Wcf.Service1" behaviorConfiguration=""&gt;
          &lt;endpoint name="ws2007FederationHttpBinding.Service1" address="ws2007FederationHttpBinding" binding="ws2007FederationHttpBinding" contract="Wcf.IService1" /&gt;
        &lt;/service&gt;    
      &lt;/services&gt;
    &lt;/system.serviceModel&gt;
    &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true" /&gt;
      &lt;directoryBrowse enabled="true" /&gt;
    &lt;/system.webServer&gt;
    &lt;system.identityModel&gt;
      &lt;identityConfiguration saveBootstrapContext="true"&gt;
        &lt;audienceUris&gt;
          &lt;add value="https://estnbr363.nobre.local/Service1.svc" /&gt;
        &lt;/audienceUris&gt;
        &lt;issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry"&gt;
          &lt;authority name="https://nobre-security.accesscontrol.windows.net/"&gt;
            &lt;keys&gt;
              &lt;add thumbprint="213D414F8E89D865FD10A49C8C8F838A9460EBEE" /&gt;
            &lt;/keys&gt;
            &lt;validIssuers&gt;
              &lt;add name="https://nobre-security.accesscontrol.windows.net/" /&gt;
            &lt;/validIssuers&gt;
          &lt;/authority&gt;
        &lt;/issuerNameRegistry&gt;      
        &lt;certificateValidation certificateValidationMode="None" /&gt;
      &lt;/identityConfiguration&gt;
    &lt;/system.identityModel&gt;  
  &lt;/configuration&gt;
  </code></pre>
  
  <p>line error</p>
  
  <pre><code>channel.GetData(1);
  </code></pre>
  
  <p>The address of the issuer of the security token was not specified. An explicit issuer address must be specified on the link to '<a href="https://estnbr363.nobre.local/Service1.svc" rel="nofollow">https://estnbr363.nobre.local/Service1.svc</a>' destination or sender's address location must be configured in the credentials.</p>
  
  <pre><code>the problem are these lines below! how to implement ?
  
    // Extract the STS certificate from the certificate store. ?????????
        X509Store store = new X509Store(StoreName.TrustedPeople, StoreLocation.CurrentUser);
        store.Open(OpenFlags.ReadOnly);
        X509Certificate2Collection certs = store.Certificates.Find(
            X509FindType.FindByThumbprint, "0000000000000000000000000000000000000000", false);
        store.Close();
  
        // Create an EndpointIdentity from the STS certificate. ???????????
        EndpointIdentity identity = EndpointIdentity.CreateX509CertificateIdentity ( certs[0] );
  
        // Set the IssuerAddress using the address of the STS and the previously created ???????
  
        // EndpointIdentity.
        b.Security.Message.IssuerAddress = 
            new EndpointAddress(new Uri("http://localhost:8000/sts/x509"), identity);
  </code></pre>