title: ws2007FederationHttpBinding and WIF delegation
body: <p>I have a website that logs in using an STS, then gets a delegated token using the bootstrap token.  I am then trying to use the delgated token to connect to a WCF service.  I believe its my WCF config thats wrong.  I've tried so many different configurations I'm lost.</p>
  
  <p>I've gotten various errors from "Description    Failed to lookup a channel to receive an incoming message. Either the endpoint or the SOAP action was not found." To Audience URI missing in the SAML token.</p>
  
  <p>I'm fairly sure its the federated configurations.</p>
  
  <p>Any ideas would be helpful!! </p>
  
  <p>Or anybody have an example of delegation to a wcf service?</p>
  
  <p>Thanks!</p>
  
  <p>This is the channel factory code.</p>
  
  <pre><code>  private static IService1 GetServiceProxy(SecurityToken token)
      {
          var binding = new WS2007FederationHttpBinding(WSFederationHttpSecurityMode.TransportWithMessageCredential);
          binding.Security.Message.EstablishSecurityContext = false;
  
          var factory = new ChannelFactory&lt;IService1&gt;(
              binding,
              new EndpointAddress(serviceAddress));
          factory.Credentials.SupportInteractive = false;
          factory.ConfigureChannelFactory();
  
          var channel = factory.CreateChannelWithIssuedToken(token);
          return channel;
  
      }
  </code></pre>
  
  <p>This is the services config.  I've got 3 various sub-bindings that i've tried as well.</p>
  
  <pre><code>  &lt;system.serviceModel&gt;
  
    &lt;diagnostics&gt;
      &lt;messageLogging logMessagesAtServiceLevel="true" 
                      logMessagesAtTransportLevel="true" 
                      logKnownPii="true"
                      logEntireMessage="true" 
                      logMalformedMessages="true" /&gt;
    &lt;/diagnostics&gt;
  
    &lt;bindings&gt;
  
      &lt;ws2007FederationHttpBinding&gt;
        &lt;binding name="ServiceHost_Service1"&gt;
          &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;message establishSecurityContext="false" issuedKeyType="SymmetricKey"&gt;
              &lt;issuerMetadata address="https://localhost/sts2/issue/wstrust/mex"/&gt;
              &lt;issuer address="http://localhost/sts2/issue/wstrust/message/username" 
                      binding="ws2007HttpBinding" 
                      bindingConfiguration="https://localhost/sts2/issue/wstrust/message/username"&gt;
                &lt;identity&gt;
                  &lt;certificate encodedValue="certblahblah"/&gt;
                &lt;/identity&gt;  
              &lt;/issuer&gt;
              &lt;tokenRequestParameters&gt;&lt;/tokenRequestParameters&gt;
            &lt;/message&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
      &lt;/ws2007FederationHttpBinding&gt;
  
      &lt;ws2007HttpBinding&gt;
  
        &lt;binding name="https://localhost/sts2/issue/wstrust/mixed/username"
              closeTimeout="00:01:00"
              openTimeout="00:01:00"
              receiveTimeout="00:10:00"
              sendTimeout="00:01:00"
              bypassProxyOnLocal="false"
              transactionFlow="false"
              hostNameComparisonMode="StrongWildcard"
              maxBufferPoolSize="524288"
              maxReceivedMessageSize="65536"
              messageEncoding="Text"
              textEncoding="utf-8"
              useDefaultWebProxy="true"
              allowCookies="false"&gt;
          &lt;readerQuotas maxDepth="32"
                        maxStringContentLength="8192"
                        maxArrayLength="16384"
                        maxBytesPerRead="4096"
                        maxNameTableCharCount="16384" /&gt;
          &lt;reliableSession ordered="true"
                           inactivityTimeout="00:10:00"
                           enabled="false" /&gt;
          &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;transport clientCredentialType="None"
                       proxyCredentialType="None"
                       realm="" /&gt;
            &lt;message clientCredentialType="UserName"
                     negotiateServiceCredential="true"
                     algorithmSuite="Default"
                     establishSecurityContext="false" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
  
        &lt;binding name="https://localhost/sts2/issue/wstrust/mixed/certificate"
               closeTimeout="00:01:00"
               openTimeout="00:01:00"
               receiveTimeout="00:10:00"
               sendTimeout="00:01:00"
               bypassProxyOnLocal="false"
               transactionFlow="false"
               hostNameComparisonMode="StrongWildcard"
               maxBufferPoolSize="524288"
               maxReceivedMessageSize="65536"
               messageEncoding="Text"
               textEncoding="utf-8"
               useDefaultWebProxy="true"
               allowCookies="false"&gt;
          &lt;readerQuotas maxDepth="32"
                        maxStringContentLength="8192"
                        maxArrayLength="16384"
                        maxBytesPerRead="4096"
                        maxNameTableCharCount="16384" /&gt;
          &lt;reliableSession ordered="true"
                           inactivityTimeout="00:10:00"
                           enabled="false" /&gt;
          &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;transport clientCredentialType="None"
                       proxyCredentialType="None"
                       realm="" /&gt;
            &lt;message clientCredentialType="Certificate"
                     negotiateServiceCredential="true"
                     algorithmSuite="Default"
                     establishSecurityContext="false" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
  
        &lt;binding name="https://localhost/sts2/issue/wstrust/message/username"
              closeTimeout="00:01:00"
              openTimeout="00:01:00"
              receiveTimeout="00:10:00"
              sendTimeout="00:01:00"
              bypassProxyOnLocal="false"
              transactionFlow="false"
              hostNameComparisonMode="StrongWildcard"
              maxBufferPoolSize="524288"
              maxReceivedMessageSize="65536"
              messageEncoding="Text"
              textEncoding="utf-8"
              useDefaultWebProxy="true"
              allowCookies="false"&gt;
          &lt;readerQuotas maxDepth="32"
                        maxStringContentLength="8192"
                        maxArrayLength="16384"
                        maxBytesPerRead="4096"
                        maxNameTableCharCount="16384" /&gt;
          &lt;reliableSession ordered="true"
                           inactivityTimeout="00:10:00"
                           enabled="false" /&gt;
          &lt;security mode="Message"&gt;
            &lt;transport clientCredentialType="Windows"
                       proxyCredentialType="None"
                       realm="" /&gt;
            &lt;message clientCredentialType="UserName"
                     negotiateServiceCredential="false"
                     algorithmSuite="Default"
                     establishSecurityContext="false" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
  
      &lt;/ws2007HttpBinding&gt;
    &lt;/bindings&gt;
  
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior&gt;
        &lt;federatedServiceHostConfiguration/&gt;
        &lt;!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --&gt;
        &lt;serviceMetadata httpGetEnabled="true"/&gt;
        &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
  
        &lt;serviceCredentials&gt;
          &lt;serviceCertificate  findValue="1d076d8f9dff87a44b59d09ec0e1bc60"
                    storeLocation="LocalMachine"
                    storeName="My"
                    x509FindType="FindBySerialNumber"&gt;
          &lt;/serviceCertificate&gt;
        &lt;/serviceCredentials&gt;
  
      &lt;/behavior&gt;
  
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  
  &lt;extensions&gt;
        &lt;behaviorExtensions&gt;
          &lt;add name="federatedServiceHostConfiguration"
               type="Microsoft.IdentityModel.Configuration.ConfigureServiceHostBehaviorExtensionElement, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/&gt;
        &lt;/behaviorExtensions&gt;
  &lt;/extensions&gt;
  
  &lt;services&gt;
    &lt;service name="ServiceHost_Service1"&gt;
      &lt;endpoint binding="ws2007FederationHttpBinding"
                bindingConfiguration="ServiceHost_Service1"
                contract="ServiceHost.IService1"&gt;
        &lt;identity&gt;
          &lt;servicePrincipalName value="localhost"/&gt;
          &lt;certificate encodedValue="certblahblah"/&gt;
        &lt;/identity&gt;
      &lt;/endpoint&gt;
      &lt;endpoint address="MEX" binding="mexHttpBinding" bindingConfiguration="" contract="IMetadataExchange"/&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  
  &lt;!--&lt;client&gt;
    &lt;endpoint binding="customBinding" 
              bindingConfiguration="ServiceHost_Service1"
              contract="ServiceHost.IService1"&gt;
      &lt;identity&gt;
        &lt;userPrincipalName value="localhost"/&gt;
        &lt;certificate encodedValue="certblahblahblah"/&gt;
      &lt;/identity&gt;        
    &lt;/endpoint&gt;
  
  &lt;/client&gt;--&gt;
  
  &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
  </code></pre>
  
  <p></p>
  
  <p>This is the identity config</p>
  
  <pre><code> &lt;microsoft.identityModel&gt;
  </code></pre>
  
  <p> 
      
        
        
        
      </p>
  
  <pre><code>&lt;certificateValidation revocationMode="NoCheck"
                         certificateValidationMode="None" /&gt;
  &lt;issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"&gt;
    &lt;trustedIssuers&gt;
      &lt;add thumbprint="c4e675b5add2a7d6d59bbd5e04ca30b440e23eff"
              name="Thinktecture.IdentityServer" /&gt;
    &lt;/trustedIssuers&gt;
  &lt;/issuerNameRegistry&gt;
  
  &lt;federatedAuthentication&gt;
    &lt;wsFederation passiveRedirectEnabled="false"
                  issuer="https://localhost/sts2/issue/wsfed"
                  realm="https://localhost/ServiceHost/" /&gt;
    &lt;cookieHandler requireSsl="true" /&gt;
  &lt;/federatedAuthentication&gt;
  
  &lt;serviceCertificate&gt;
    &lt;certificateReference findValue="1d076d8f9dff87a44b59d09ec0e1bc60"
                    storeLocation="LocalMachine"
                    storeName="My"
                    x509FindType="FindBySerialNumber"/&gt;
  &lt;/serviceCertificate&gt;
  </code></pre>
  
  <p>
  </p>