WIF, Federation and STS - wif

Question

In order to prepare my application to use ADFS I have to work with federation
now we have a solution with a server with federated services using WIF for security, whe have a client consuming this services and we have and STS wich taken a usename password for identifying the user.
Everything work fine, all my claims are generated correctly and I can use them in my applcation.
Now we must use ADFS in addition of our Internal IdentityProvider, I'd just take my sts and divide it between two parts, a "federation provider" called by client and trusted by server and a part in charge of authentication
For this I just add following code in my CustomSecurityTokenHandler in FederationProvider
UserNameSecurityToken userNameTokenFromRP = token as UserNameSecurityToken;
WSTrustChannelFactory stsClient = new WSTrustChannelFactory("IdentityConfiguration");
stsClient.Credentials.UserName.UserName = userNameTokenFromRP.UserName;
stsClient.Credentials.UserName.Password = userNameTokenFromRP.Password;
IWSTrustChannelContract stsProxy = stsClient.CreateChannel();
RequestSecurityToken rst = new RequestSecurityToken(WSTrust13Constants.RequestTypes.Issue, WSTrust13Constants.KeyTypes.Symmetric);
rst.AppliesTo = new System.ServiceModel.EndpointAddress("http://localhost:8010/FederationProvider.svc");
rst.Claims.Add(new RequestClaim("http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name", false));
rst.Issuer = new System.ServiceModel.EndpointAddress("http://localhost:8020/IdentityProvider.svc");
rst.Lifetime = new Lifetime(DateTime.Now, DateTime.Now + new TimeSpan(0, 30, 0));
rst.TokenType = Microsoft.IdentityModel.Tokens.SecurityTokenTypes.OasisWssSaml11TokenProfile11;
RequestSecurityTokenResponse rstr;
var stsToken = stsProxy.Issue(rst, out rstr);
and this in my Web.config file:
<client>
<endpoint name="IdentityConfiguration" address="http://localhost:8020/IdentityProvider.svc"
binding="ws2007HttpBinding" bindingConfiguration="SecurityTokenBinding"
contract="Microsoft.IdentityModel.Protocols.WSTrust.IWSTrustChannelContract">
<identity>
<certificate encodedValue="MyEncodedValue" />
</identity>
</endpoint>
</client>
On identity side I continue generate my claims the same way I did before
The problem I have is in my RSTR the token is null and tokenXML is encrypted, I don't understand how to use federation in this case?
If someone can help me?
thanks for reading me
Ange

Answer 1

Finally, I've understand what is missing
I have to create a security token handler and a Token resolver
GenericXmlSecurityToken augmentedToken = (GenericXmlSecurityToken) stsToken;
var tokenReader = new StringReader(augmentedToken.TokenXml.OuterXml);
var reader = XmlReader.Create(tokenReader);
SecurityTokenHandlerCollection handlers = SecurityTokenHandlerCollection.CreateDefaultSecurityTokenHandlerCollection();
X509Store store = new X509Store(StoreName.My, StoreLocation.LocalMachine);
store.Open(OpenFlags.ReadOnly);
X509Certificate2Collection certificates = store.Certificates;
X509Certificate2 certificate = certificates.Find(X509FindType.FindByThumbprint, "MyThumbprint", true)[0];
List<SecurityToken> serviceTokens = new List<SecurityToken>();
serviceTokens.Add(new X509SecurityToken(certificate));
SecurityTokenResolver serviceResolver = SecurityTokenResolver.CreateDefaultSecurityTokenResolver(serviceTokens.AsReadOnly(), false);
handlers.Configuration.ServiceTokenResolver = serviceResolver;
handlers.Configuration.AudienceRestriction.AllowedAudienceUris.
Add(new Uri("http://localhost:8010/FederationProvider.svc"));
var registry = new ConfigurationBasedIssuerNameRegistry();
registry.AddTrustedIssuer("Thumbprint", "http://localhost:8020/IdentityProvider.svc");
handlers.Configuration.IssuerNameRegistry = registry;
var samlToken = handlers.ReadToken(reader);
IClaimsIdentity identity = handlers.ValidateToken(samlToken)[0];
it works fine and code's coming from alexthissen