title: Requesting a SAML 2.0 security token from a WS-Trust STS using WIF 4.5
body: <p>I am able to request a SAML 1.1 token using by specifying TokenType=SecurityTokenTypes.Saml in the RequestSecurityToken message. I am able to convert this to a ClaimsPrincipal and view the claims.</p>
  
  <p>However, when I want to request a SAML 2.0 token by changing TokenType to the namespace "<a href="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0" rel="nofollow noreferrer">http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0</a>", I get an exception that includes the following.</p>
  
  <blockquote>
    <p>System.Xml.XmlException: 'Cannot read KeyIdentifierClause from element
    'Reference' with namespace
    '<a href="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" rel="nofollow noreferrer">http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd</a>'.
    Custom KeyIdentifierClauses require custom SecurityTokenSerializers,
    please refer to the SDK for examples.'</p>
  </blockquote>
  
  <p>I was wondering if SAML 2.0 tokens are support when being requested from a WS-Trust 1.3 security token service, and if so, how is it requested? The SecurityTokenTypes constants class provided by Microsoft only contains a single "Saml" that doesn't specify the version, and funny enough, references a Microsoft-specific namespace.</p>
  
  <p>I know that Microsoft has provided supporting classes for SAML 2.0 tokens, such as Saml2SecurityTokenHandler, but I seem to be unable to actually request one from the STS.</p>
  
  <p>Here is my code below.</p>
  
  <pre><code>using System;
  using System.IdentityModel.Protocols.WSTrust;
  using System.IdentityModel.Selectors;
  using System.IdentityModel.Tokens;
  using System.IO;
  using System.Linq;
  using System.Security.Claims;
  using System.ServiceModel;
  using System.ServiceModel.Security;
  using System.Xml;
  
  namespace WsTrustActiveSTSClient
  {
      internal class Program
      {
          private const string relyingPartyId = "http://localhost/myApp";
          private const string stsEndpoint = "https://localhost:9443/services/wso2carbon-sts";
  
          private static void Main(string[] args)
          {
              WS2007HttpBinding binding = new WS2007HttpBinding(SecurityMode.TransportWithMessageCredential, false);
  
              binding.Security.Message.ClientCredentialType = MessageCredentialType.UserName;
              binding.Security.Message.EstablishSecurityContext = false;
  
  
              EndpointAddress endpoint = new EndpointAddress(stsEndpoint);
  
              WSTrustChannelFactory factory = new WSTrustChannelFactory(binding, endpoint);
              factory.TrustVersion = TrustVersion.WSTrust13;
  
              factory.Credentials.UserName.UserName = "admin";
              factory.Credentials.UserName.Password = "admin";
  
              WSTrustChannel channel = (WSTrustChannel) factory.CreateChannel();
  
              RequestSecurityToken rst = new RequestSecurityToken
              {
                  RequestType = RequestTypes.Issue,
                  KeyType = KeyTypes.Bearer,
                  AppliesTo = new EndpointReference(relyingPartyId),              
                  Claims =
                  {
                      new RequestClaim("http://wso2.org/claims/givenname"),
                      new RequestClaim("http://wso2.org/claims/emailaddress")
                  },
                  //TokenType = SecurityTokenTypes.Saml
                  TokenType = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
              };
  
              GenericXmlSecurityToken genericXmlSecurityToken = (GenericXmlSecurityToken) channel.Issue(rst, out RequestSecurityTokenResponse rstr);          
  
              Console.WriteLine("{0}\n{1}\n\n", genericXmlSecurityToken, genericXmlSecurityToken.TokenXml.OuterXml);
  
              SecurityTokenHandlerCollection tokenHandlers = new SecurityTokenHandlerCollection(
                  new SecurityTokenHandler[]
                  {
                      new SamlSecurityTokenHandler(), 
                      new Saml2SecurityTokenHandler()
                  }
              );
              tokenHandlers.Configuration.AudienceRestriction = new AudienceRestriction();
              tokenHandlers.Configuration.AudienceRestriction.AllowedAudienceUris.Add(new Uri(relyingPartyId));
  
              TrustedIssuerNameRegistry trustedIssuerNameRegistry = new TrustedIssuerNameRegistry();
              tokenHandlers.Configuration.IssuerNameRegistry = trustedIssuerNameRegistry;
  
              SecurityToken token =
                  tokenHandlers.ReadToken(
                      new XmlTextReader(new StringReader(genericXmlSecurityToken.TokenXml.OuterXml)));
  
              ClaimsPrincipal claimsPrincipal = new ClaimsPrincipal(tokenHandlers.ValidateToken(token).First());
  
              Console.WriteLine("Name : " + claimsPrincipal.Identity.Name);
              Console.WriteLine("Auth Type : " + claimsPrincipal.Identity.AuthenticationType);
              Console.WriteLine("Is Authed : " + claimsPrincipal.Identity.IsAuthenticated);
              foreach (Claim c in claimsPrincipal.Claims)
                  Console.WriteLine("{0}:{1}", c.Type, c.Value);
  
              Console.ReadLine();
          }
  
          public class TrustedIssuerNameRegistry : IssuerNameRegistry
          {
              public override string GetIssuerName(SecurityToken securityToken)
              {
                  return "Trusted Issuer";
                  // throw new SecurityTokenException("Untrusted issuer.");
              }
          }
      }
  }
  </code></pre>
  
  <p>When I don't specify a TokenType in the RST this is the SOAP message that gets sent to the WS-Trust STS.</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://www.w3.org/2003/05/soap-envelope" xmlns:a="http://www.w3.org/2005/08/addressing" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
     &lt;s:Header&gt;
        &lt;a:Action s:mustUnderstand="1"&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/RST/Issue&lt;/a:Action&gt;
        &lt;a:MessageID&gt;urn:uuid:bb24c76a-b737-4a9b-8526-26b84a28bbe8&lt;/a:MessageID&gt;
        &lt;a:ReplyTo&gt;
           &lt;a:Address&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/a:Address&gt;
        &lt;/a:ReplyTo&gt;
        &lt;a:To s:mustUnderstand="1"&gt;https://localhost:9443/services/wso2carbon-sts&lt;/a:To&gt;
        &lt;o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" s:mustUnderstand="1"&gt;
           &lt;u:Timestamp u:Id="_0"&gt;
              &lt;u:Created&gt;2017-10-17T14:50:01.517Z&lt;/u:Created&gt;
              &lt;u:Expires&gt;2017-10-17T14:55:01.517Z&lt;/u:Expires&gt;
           &lt;/u:Timestamp&gt;
           &lt;o:UsernameToken u:Id="uuid-b6a803fc-b1fe-4186-8c3e-dcf4b1a647e5-1"&gt;
              &lt;o:Username&gt;admin&lt;/o:Username&gt;
              &lt;o:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText"&gt;admin&lt;/o:Password&gt;
           &lt;/o:UsernameToken&gt;
        &lt;/o:Security&gt;
     &lt;/s:Header&gt;
     &lt;s:Body&gt;
        &lt;trust:RequestSecurityToken xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;
           &lt;wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"&gt;
              &lt;wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
                 &lt;wsa:Address&gt;http://localhost/myApp&lt;/wsa:Address&gt;
              &lt;/wsa:EndpointReference&gt;
           &lt;/wsp:AppliesTo&gt;
           &lt;trust:Claims xmlns:i="http://schemas.xmlsoap.org/ws/2005/05/identity" Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity"&gt;
              &lt;i:ClaimType Uri="http://wso2.org/claims/givenname" Optional="false"/&gt;
              &lt;i:ClaimType Uri="http://wso2.org/claims/emailaddress" Optional="false"/&gt;
           &lt;/trust:Claims&gt;
           &lt;trust:KeyType&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer&lt;/trust:KeyType&gt;
           &lt;trust:RequestType&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/Issue&lt;/trust:RequestType&gt;
        &lt;/trust:RequestSecurityToken&gt;
     &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>And here is the response from WSO2 Identity Server.</p>
  
  <pre><code>   &lt;soapenv:Envelope xmlns:soapenv="http://www.w3.org/2003/05/soap-envelope"&gt;
        &lt;soapenv:Header xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
           &lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" soapenv:mustUnderstand="true"&gt;
              &lt;wsu:Timestamp xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" wsu:Id="Timestamp-1"&gt;
                 &lt;wsu:Created&gt;2017-10-17T14:50:02.407Z&lt;/wsu:Created&gt;
                 &lt;wsu:Expires&gt;2017-10-17T14:55:02.407Z&lt;/wsu:Expires&gt;
              &lt;/wsu:Timestamp&gt;
           &lt;/wsse:Security&gt;
           &lt;wsa:Action&gt;http://docs.oasis-open.org/ws-sx/ws-trust/200512/RSTR/Issue&lt;/wsa:Action&gt;
           &lt;wsa:RelatesTo&gt;urn:uuid:bb24c76a-b737-4a9b-8526-26b84a28bbe8&lt;/wsa:RelatesTo&gt;
        &lt;/soapenv:Header&gt;
        &lt;soapenv:Body&gt;
           &lt;wst:RequestSecurityTokenResponseCollection xmlns:wst="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;
              &lt;wst:RequestSecurityTokenResponse&gt;
                 &lt;wst:TokenType&gt;http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1&lt;/wst:TokenType&gt;
                 &lt;wst:RequestedAttachedReference&gt;
                    &lt;wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
                       &lt;wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID"&gt;_d8c5ef71f6665284b3ba5f7aca69f08b&lt;/wsse:KeyIdentifier&gt;
                    &lt;/wsse:SecurityTokenReference&gt;
                 &lt;/wst:RequestedAttachedReference&gt;
                 &lt;wst:RequestedUnattachedReference&gt;
                    &lt;wsse:SecurityTokenReference xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
                       &lt;wsse:KeyIdentifier ValueType="http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.0#SAMLAssertionID"&gt;_d8c5ef71f6665284b3ba5f7aca69f08b&lt;/wsse:KeyIdentifier&gt;
                    &lt;/wsse:SecurityTokenReference&gt;
                 &lt;/wst:RequestedUnattachedReference&gt;
                 &lt;wsp:AppliesTo xmlns:wsp="http://schemas.xmlsoap.org/ws/2004/09/policy"&gt;
                    &lt;wsa:EndpointReference xmlns:wsa="http://www.w3.org/2005/08/addressing"&gt;
                       &lt;wsa:Address&gt;http://localhost/myApp&lt;/wsa:Address&gt;
                    &lt;/wsa:EndpointReference&gt;
                 &lt;/wsp:AppliesTo&gt;
                 &lt;wst:Lifetime&gt;
                    &lt;wsu:Created xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2017-10-17T14:50:02.236Z&lt;/wsu:Created&gt;
                    &lt;wsu:Expires xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;2017-10-17T14:55:02.236Z&lt;/wsu:Expires&gt;
                 &lt;/wst:Lifetime&gt;
                 &lt;wst:RequestedSecurityToken&gt;
                    &lt;Assertion xmlns="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:samlp="urn:oasis:names:tc:SAML:1.0:protocol" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" AssertionID="_d8c5ef71f6665284b3ba5f7aca69f08b" IssueInstant="2017-10-17T14:50:02.282Z" Issuer="https://localhost" MajorVersion="1" MinorVersion="1"&gt;
                       &lt;Conditions NotBefore="2017-10-17T14:50:02.236Z" NotOnOrAfter="2017-10-17T14:55:02.236Z"&gt;
                          &lt;AudienceRestrictionCondition&gt;
                             &lt;Audience&gt;http://localhost/myApp&lt;/Audience&gt;
                          &lt;/AudienceRestrictionCondition&gt;
                       &lt;/Conditions&gt;
                       &lt;AuthenticationStatement AuthenticationInstant="2017-10-17T14:50:02.236Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password"&gt;
                          &lt;Subject&gt;
                             &lt;NameIdentifier Format="urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress"&gt;admin&lt;/NameIdentifier&gt;
                             &lt;SubjectConfirmation&gt;
                                &lt;ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:bearer&lt;/ConfirmationMethod&gt;
                             &lt;/SubjectConfirmation&gt;
                          &lt;/Subject&gt;
                       &lt;/AuthenticationStatement&gt;
                       &lt;ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;
                          &lt;ds:SignedInfo&gt;
                             &lt;ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"/&gt;
                             &lt;ds:SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1"/&gt;
                             &lt;ds:Reference URI="#_d8c5ef71f6665284b3ba5f7aca69f08b"&gt;
                                &lt;ds:Transforms&gt;
                                   &lt;ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature"/&gt;
                                   &lt;ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"&gt;
                                      &lt;ec:InclusiveNamespaces xmlns:ec="http://www.w3.org/2001/10/xml-exc-c14n#" PrefixList="code ds kind rw saml samlp typens #default xsd xsi"/&gt;
                                   &lt;/ds:Transform&gt;
                                &lt;/ds:Transforms&gt;
                                &lt;ds:DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1"/&gt;
                                &lt;ds:DigestValue&gt;8w9YHsb+YIyUCzGjqh6q0JrjxTI=&lt;/ds:DigestValue&gt;
                             &lt;/ds:Reference&gt;
                          &lt;/ds:SignedInfo&gt;
                          &lt;ds:SignatureValue&gt;Evm0H2+hOMWdsrK0Rp8HPCDDldMJ+AHPgv4hrqKW6IuPGFT25DhTRoIc+cPuerFOABYX5B1Om0v4VlmqsalpK2V7tdzHlrDbrOCiENL4FhdATd48o/IiRjde8XM0B7gHAIJoMSimg3Fc/jPXH4kyMsLAWM+l0GdK8VxKVLPtrhY=&lt;/ds:SignatureValue&gt;
                          &lt;ds:KeyInfo&gt;
                             &lt;ds:X509Data&gt;
                                &lt;ds:X509Certificate&gt;MIICNTCCAZ6gAwIBAgIES343gjANBgkqhkiG9w0BAQUFADBVMQswCQYDVQQGEwJVUzELMAkGA1UECAwCQ0ExFjAUBgNVBAcMDU1vdW50YWluIFZpZXcxDTALBgNVBAoMBFdTTzIxEjAQBgNVBAMMCWxvY2FsaG9zdDAeFw0xMDAyMTkwNzAyMjZaFw0zNTAyMTMwNzAyMjZaMFUxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEWMBQGA1UEBwwNTW91bnRhaW4gVmlldzENMAsGA1UECgwEV1NPMjESMBAGA1UEAwwJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCUp/oV1vWc8/TkQSiAvTousMzOM4asB2iltr2QKozni5aVFu818MpOLZIr8LMnTzWllJvvaA5RAAdpbECb+48FjbBe0hseUdN5HpwvnH/DW8ZccGvk53I6Orq7hLCv1ZHtuOCokghz/ATrhyPq+QktMfXnRS4HrKGJTzxaCcU7OQIDAQABoxIwEDAOBgNVHQ8BAf8EBAMCBPAwDQYJKoZIhvcNAQEFBQADgYEAW5wPR7cr1LAdq+IrR44iQlRG5ITCZXY9hI0PygLP2rHANh+PYfTmxbuOnykNGyhM6FjFLbW2uZHQTY1jMrPprjOrmyK5sjJRO4d1DeGHT/YnIjs9JogRKv4XHECwLtIVdAbIdWHEtVZJyMSktcyysFcvuhPQK8Qc/E/Wq8uHSCo=&lt;/ds:X509Certificate&gt;
                             &lt;/ds:X509Data&gt;
                          &lt;/ds:KeyInfo&gt;
                       &lt;/ds:Signature&gt;
                    &lt;/Assertion&gt;
                 &lt;/wst:RequestedSecurityToken&gt;
              &lt;/wst:RequestSecurityTokenResponse&gt;
           &lt;/wst:RequestSecurityTokenResponseCollection&gt;
        &lt;/soapenv:Body&gt;
     &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>As you can see, WSO2 Identity Server is returning a mixture of SAML 1.0 and SAML 1.1 namespaces.</p>