title: WIF STS ID3242: The security token could not be authenticated or authorized
body: <p>I'm getting the following error in my client application when it tries to authenticate to my service:</p>
  
  <blockquote>
    <p>ID3242: The security token could not be authenticated or authorized</p>
  </blockquote>
  
  <p>Here is the configuration of the client:</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
  &lt;system.serviceModel&gt;
  &lt;bindings&gt;
    &lt;ws2007HttpBinding&gt;
      &lt;binding name="stsBinding"&gt;
        &lt;security mode="Message"&gt;
          &lt;message clientCredentialType="UserName"
            establishSecurityContext="false"
            negotiateServiceCredential="true"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/ws2007HttpBinding&gt;
    &lt;ws2007FederationHttpBinding&gt;
      &lt;binding name="echoClaimsBinding"&gt;
        &lt;security mode="Message"&gt;
          &lt;message&gt;
            &lt;claimTypeRequirements&gt;
              &lt;add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="false"/&gt;
            &lt;/claimTypeRequirements&gt;
            &lt;issuer address="http://localhost:17240/STS.svc"
                    bindingConfiguration="stsBinding"
                    binding="ws2007HttpBinding"&gt;
              &lt;identity&gt;
                &lt;dns value="WCFSTS"/&gt;
              &lt;/identity&gt;
            &lt;/issuer&gt;
            &lt;issuerMetadata address="http://localhost:17240/STS.svc/Mex"&gt;&lt;/issuerMetadata&gt;
          &lt;/message&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/ws2007FederationHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;behaviors&gt;
    &lt;endpointBehaviors&gt;
      &lt;behavior name="echoClaimsBehavior"&gt;
        &lt;clientCredentials&gt;
          &lt;serviceCertificate&gt;
            &lt;defaultCertificate
              findValue="CN=WCFSTS"
              storeLocation="LocalMachine"
              storeName="My"
              x509FindType="FindBySubjectDistinguishedName"/&gt;
            &lt;authentication
              revocationMode="NoCheck"
              certificateValidationMode="None"/&gt;
          &lt;/serviceCertificate&gt;
        &lt;/clientCredentials&gt;
      &lt;/behavior&gt;
    &lt;/endpointBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;client&gt;
    &lt;endpoint address="http://localhost:1438/EchoClaims.svc/EchoClaims"
              binding="ws2007FederationHttpBinding"
              bindingConfiguration="echoClaimsBinding"
              contract="TestService.IEchoClaims"
              name="WS2007FederationHttpBinding_IEchoClaims"
              behaviorConfiguration="echoClaimsBehavior"&gt;
      &lt;identity&gt;
        &lt;dns value="WCFServer"/&gt;
      &lt;/identity&gt;
    &lt;/endpoint&gt;
  &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Here is the configuration of the service</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
  &lt;configSections&gt;
  &lt;section name="microsoft.identityModel" type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" /&gt;
  &lt;/configSections&gt;
  
  &lt;system.web&gt;
  &lt;compilation debug="true" targetFramework="4.0"&gt;
    &lt;assemblies&gt;
      &lt;add assembly="Microsoft.IdentityModel, Version=3.5.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" /&gt;
    &lt;/assemblies&gt;
  &lt;/compilation&gt;
  &lt;/system.web&gt;
  
  &lt;system.serviceModel&gt;
  &lt;services&gt;
    &lt;service name="WcfService1.EchoClaims"
             behaviorConfiguration="echoClaimsBehavior"&gt;
  
      &lt;endpoint address=""
                contract="WcfService1.IEchoClaims"
                binding="ws2007FederationHttpBinding"
                bindingConfiguration="echoClaimsBinding"&gt;&lt;/endpoint&gt;
      &lt;endpoint address="mex"
             binding="mexHttpBinding"
             contract="IMetadataExchange" /&gt;
    &lt;/service&gt;
  &lt;/services&gt;
  &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="echoClaimsBehavior"&gt;
  
        &lt;serviceMetadata httpGetEnabled="true" /&gt;
        &lt;serviceCredentials&gt;           
          &lt;serviceCertificate 
            findValue="CN=WCFServer" 
            storeLocation="LocalMachine" 
            storeName="My" 
            x509FindType="FindBySubjectDistinguishedName" /&gt;
        &lt;/serviceCredentials&gt;
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  &lt;/behaviors&gt;
  &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
  
  &lt;bindings&gt;
    &lt;ws2007FederationHttpBinding&gt;
      &lt;binding name="echoClaimsBinding"&gt;
        &lt;security mode="Message"&gt;
          &lt;message negotiateServiceCredential="true"&gt;
            &lt;!--&lt;issuerMetadata address="http://localhost:17240/STS.svc/mex" /&gt;--&gt;
            &lt;claimTypeRequirements&gt;
              &lt;!--Following are the claims offered by STS 'http://localhost:17240/STS.svc'. Add or uncomment claims that you require by your application and then update the federation metadata of this application.--&gt;
              &lt;add claimType="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" isOptional="false" /&gt;               
            &lt;/claimTypeRequirements&gt;
          &lt;/message&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/ws2007FederationHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;diagnostics&gt;
    &lt;messageLogging logEntireMessage="true"
                    logMessagesAtServiceLevel="true"
                    logMessagesAtTransportLevel="true"&gt;&lt;/messageLogging&gt;
  &lt;/diagnostics&gt;
  &lt;/system.serviceModel&gt;
  &lt;system.webServer&gt;
  &lt;modules runAllManagedModulesForAllRequests="true" /&gt;
  &lt;/system.webServer&gt;
  &lt;microsoft.identityModel&gt;
  &lt;service&gt;
    &lt;audienceUris mode="Never"/&gt;        
    &lt;issuerNameRegistry type="WcfService1.CustomIssuerNameRegistry, WcfService1"/&gt;        
  &lt;/service&gt;
  &lt;/microsoft.identityModel&gt;
  &lt;system.diagnostics&gt;
  &lt;sources&gt;
    &lt;source name="System.ServiceModel" switchValue="Warning, Error, ActivityTracing"
         propagateActivity="true"&gt;
      &lt;listeners&gt;
        &lt;add name="ServiceModelTraceListener"/&gt;
      &lt;/listeners&gt;
    &lt;/source&gt;
  &lt;/sources&gt;
  &lt;sharedListeners&gt;
    &lt;add initializeData="ecb_tracelog.svclog"
                  type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
                  name="ServiceModelTraceListener" traceOutputOptions="Timestamp"&gt;
      &lt;filter type="" /&gt;
    &lt;/add&gt;
  &lt;/sharedListeners&gt;
  &lt;trace autoflush="true" /&gt;
  &lt;/system.diagnostics&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Please let me know if anyone has an idea of how to determine why authentication is failing.  I have Geneva STS tracing on verbose, but it's not giving me any messages about why the certificate isn't being authenticated. </p>