title: Windows NT token with ADFS to get Remote user Roles
body: <p>I created a ADFS windows NT enabled tokenapp
  Configured IIS 7 to enabled windows NT token in authentication  and reply url as <a href="https://adfsweb.treyresearch.net/tokenapp" rel="nofollow">https://adfsweb.treyresearch.net/tokenapp</a></p>
  
  <p>I added this app into the adfsresource application as Windows NT token based application.</p>
  
  <p>Using this web.config file (http://blogs.technet.com/b/adfs_documentation/archive/2006/08/03/444865.aspx#DSDOC_BKMK_667328988_f5db_446a_9261_00b4)</p>
  
  <p>The default.aspx.cs as below.</p>
  
  <pre><code>using System;
  using System.Data;
  using System.Configuration;
  using System.Web;
  using System.Web.Security;
  using System.Web.UI;
  using System.Web.UI.WebControls;
  using System.Web.UI.WebControls.WebParts;
  using System.Web.UI.HtmlControls;
  using System.Security.Principal;
  
  public partial class _Default : System.Web.UI.Page 
  {
      protected void Page_Load(object sender, EventArgs e)
      {
          Label1.Text = HttpContext.Current.User.Identity.Name;
          WindowsIdentity i = (WindowsIdentity)HttpContext.Current.User.Identity;
  
          IdentityReferenceCollection irc = i.Groups;
  
          foreach (IdentityReference ir in irc)
          {
              Label2.Text += ir.Translate(typeof(NTAccount)).Value.ToString() + "; ";
  
          }
  
      }
  }
  </code></pre>
  
  <p>It works as long as I log in from adfsresources domain with treyresearch,net user.</p>
  
  <p>If I use this tokenappp url from adatum.com domain I get a error, and on event log of adfsresource server i have this error:</p>
  
  <pre><code>Event code: 4011 
  Event message: An unhandled access exception has occurred. 
  Event time: 11/29/2011 7:20:26 PM 
  Event time (UTC): 11/30/2011 1:20:26 AM 
  Event ID: ac49318023ee4ba4ab7ab6e0bca78522 
  Event sequence: 5 
  Event occurrence: 2 
  Event detail code: 0 
  
  Application information: 
      Application domain: /LM/W3SVC/1/ROOT/adfs-1-129670890061718750 
      Trust level: Full 
      Application Virtual Path: /adfs 
      Application Path: C:\Windows\SystemData\ADFS\sts\ 
      Machine name: ADFSRESOURCE 
  
  Process information: 
      Process ID: 1892 
      Process name: w3wp.exe 
      Account name: NT AUTHORITY\NETWORK SERVICE 
  
  Request information: 
      Request URL: https://adfsresource.treyresearch.net:443/adfs/ls/clientlogon.aspx 
      Request path: /adfs/ls/clientlogon.aspx 
      User host address: 192.168.10.133 
      User:  
      Is authenticated: False 
      Authentication Type:  
      Thread account name: NT AUTHORITY\NETWORK SERVICE 
  
  Custom event details: 
  </code></pre>
  
  <p>Does this means that I need to have Windows trust on top of ADFS trust to be using windows NT token for remote domains? if so there is no point in having ADFS trust, if i also need to have windows domain trust.</p>
  
  <p>I can get my claim app to work correctly from remote domain, but I added this new tokenapp after all the trust policy export import was completed <a href="http://technet.microsoft.com/en-us/library/cc731103%28WS.10%29.aspx" rel="nofollow">http://technet.microsoft.com/en-us/library/cc731103%28WS.10%29.aspx</a> </p>
  
  <p>I have also followed and verified this info below
  <a href="http://technet.microsoft.com/en-us/library/cc734929%28WS.10%29.aspx" rel="nofollow">http://technet.microsoft.com/en-us/library/cc734929%28WS.10%29.aspx</a></p>