title: How to process saml:Assertion in WCF?
body: <p>New to WCF, but very familiar with past WSE* paradigms. I'm finding the configurability (read: complexities) of WCF to be quite a challenge.</p>
  
  <p>I'm attempting to use a .NET 4.0 WCF Client to consume a web service provided by our government which runs on WebSphere Application Server/6.1.</p>
  
  <p>Their scheme uses a UsernameToken to authenticate and exchange for a SAML Assertion over HTTPS transport encryption. This SAML Assertion is used for the remainder of the opertations with their services.</p>
  
  <p>When attempting to "Login" (i.e. acquire the SAML Assertion), I'm getting the following exception from WCF when it attempts to process the return SOAP:</p>
  
  <p><strong>"Cannot find a token authenticator for the 'System.IdentityModel.Tokens.SamlSecurityToken' token type. Tokens of that type cannot be accepted according to current security settings."</strong></p>
  
  <p>Here's my settings file:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
  &lt;client&gt;
    &lt;endpoint binding="basicHttpBinding"
              bindingConfiguration="Default"
              contract="ServiceProxy.Login"
              name="Login" /&gt;
  &lt;/client&gt;
  &lt;bindings&gt;
    &lt;basicHttpBinding&gt;
      &lt;binding name="Default"&gt;
        &lt;security mode="TransportWithMessageCredential"&gt;
          &lt;transport clientCredentialType="None"/&gt;
          &lt;message clientCredentialType="UserName" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
  
    &lt;/basicHttpBinding&gt;
  &lt;/bindings&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>Here's the SOAP request:</p>
  
  <pre><code>&lt;s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
    &lt;s:Header&gt;
      &lt;!-- Removed --&gt;
      &lt;ActivityId CorrelationId="c9363270-1b33-4ffe-90b0-427feebcebf6" xmlns="http://schemas.microsoft.com/2004/09/ServiceModel/Diagnostics"&gt;cadd6a3c-7b36-46eb-9130-390227effc08&lt;/ActivityId&gt;
      &lt;o:Security s:mustUnderstand="1" xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
        &lt;u:Timestamp u:Id="_0"&gt;
          &lt;u:Created&gt;2012-12-13T22:50:22.308Z&lt;/u:Created&gt;
          &lt;u:Expires&gt;2012-12-13T22:55:22.308Z&lt;/u:Expires&gt;
        &lt;/u:Timestamp&gt;
        &lt;o:UsernameToken u:Id="uuid-91607d82-da2c-4004-93b6-baf5973ba057-1"&gt;
          &lt;o:Username&gt;
            &lt;!-- Removed--&gt;
          &lt;/o:Username&gt;
          &lt;o:Password&gt;
            &lt;!-- Removed--&gt;
          &lt;/o:Password&gt;
        &lt;/o:UsernameToken&gt;
      &lt;/o:Security&gt;
    &lt;/s:Header&gt;
    &lt;s:Body xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema"&gt;
      &lt;LoginRequest xmlns="http://snipped.url/Services.xsd"&gt;&lt;/LoginRequest&gt;
    &lt;/s:Body&gt;
  &lt;/s:Envelope&gt;
  </code></pre>
  
  <p>And here's the response that makes WCF choke:</p>
  
  <pre><code>&lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
      &lt;soapenv:Header&gt;
        &lt;!-- Removed --&gt;
        &lt;o:Security xmlns:o="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:mustUnderstand="1"&gt;
          &lt;saml:Assertion xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion" AssertionID="id-94ef81a2eba3b246e284f72c3313e32ababe9482" IssueInstant="2012-12-13T22:50:23.930Z" Issuer="http://www.forumsys.com/sentry" MajorVersion="1" MinorVersion="1"&gt;
            &lt;saml:Conditions NotBefore="2012-12-13T22:50:23.930Z" NotOnOrAfter="2012-12-14T08:50:23.930Z"&gt;&lt;/saml:Conditions&gt;
            &lt;saml:AuthenticationStatement AuthenticationInstant="2012-12-13T22:50:23.930Z" AuthenticationMethod="urn:oasis:names:tc:SAML:1.0:am:password"&gt;
              &lt;saml:Subject&gt;
                &lt;saml:NameIdentifier&gt;
                  &lt;!-- Removed--&gt;
                &lt;/saml:NameIdentifier&gt;
                &lt;saml:SubjectConfirmation&gt;
                  &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:sender-vouches&lt;/saml:ConfirmationMethod&gt;
                &lt;/saml:SubjectConfirmation&gt;
              &lt;/saml:Subject&gt;
              &lt;saml:SubjectLocality&gt;
                &lt;!-- Removed--&gt;
              &lt;/saml:SubjectLocality&gt;
            &lt;/saml:AuthenticationStatement&gt;
            &lt;saml:AttributeStatement&gt;
              &lt;saml:Subject&gt;
                &lt;saml:NameIdentifier&gt;
                  &lt;!-- Removed--&gt;
                &lt;/saml:NameIdentifier&gt;
                &lt;saml:SubjectConfirmation&gt;
                  &lt;saml:ConfirmationMethod&gt;urn:oasis:names:tc:SAML:1.0:cm:sender-vouches&lt;/saml:ConfirmationMethod&gt;
                &lt;/saml:SubjectConfirmation&gt;
              &lt;/saml:Subject&gt;
              &lt;saml:Attribute AttributeName="SMSESSION" AttributeNamespace="http://www.forumsys.com/sentry"&gt;
                &lt;saml:AttributeValue&gt;
                  &lt;!-- Removed--&gt;
                &lt;/saml:AttributeValue&gt;
              &lt;/saml:Attribute&gt;
            &lt;/saml:AttributeStatement&gt;
            &lt;/saml:Assertion&gt;
          &lt;u:Timestamp xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" u:Id="_0"&gt;
            &lt;u:Created&gt;2012-12-13T22:50:22.308Z&lt;/u:Created&gt;
            &lt;u:Expires&gt;2012-12-13T22:55:22.308Z&lt;/u:Expires&gt;
          &lt;/u:Timestamp&gt;
          &lt;o:UsernameToken xmlns:u="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" u:Id="uuid-91607d82-da2c-4004-93b6-baf5973ba057-1"&gt;
            &lt;o:Username&gt;
              &lt;!-- Removed--&gt;
            &lt;/o:Username&gt;
            &lt;o:Password&gt;
              &lt;!-- Removed--&gt;
            &lt;/o:Password&gt;
          &lt;/o:UsernameToken&gt;
        &lt;/o:Security&gt;
      &lt;/soapenv:Header&gt;
      &lt;soapenv:Body&gt;
        &lt;wn1:LoginResponse xmlns:wn1="http://snipped.url/Services.xsd"&gt;
          &lt;wn1:Status&gt;session counter updated&lt;/wn1:Status&gt;
        &lt;/wn1:LoginResponse&gt;
      &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>The above response is a successful response and matches prior versions running on WSE2/3 (which for other reasons I'm unable to use going forward).</p>
  
  <p>How do I get WCF to acknowledge the above response as valid? Or perhaps just to get it to ignore the fact that it can't parse it and I can manually parse it perhaps.</p>
  
  <p>I'm stumped!</p>
  
  <p><strong>UPDATE #1:</strong></p>
  
  <p>I started to go down the Custom Client credentials route. This seemed promising, if a bit complicated. </p>
  
  <p>If you want to go this route...</p>
  
  <p>1) See MS article series here: <a href="http://msdn.microsoft.com/en-us/library/ms730868(v=vs.100).aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/ms730868(v=vs.100).aspx</a></p>
  
  <p>2) Also see WCF Samples WCF\Extensibility\Security\SamlTokenProvider.</p>
  
  <p>3) Blog post using this method: <a href="http://bronumski.blogspot.com/2011/11/this-has-been-hanging-around-in-my.html" rel="nofollow">http://bronumski.blogspot.com/2011/11/this-has-been-hanging-around-in-my.html</a></p>
  
  <p>This should allow you to use SAML Assertions without WIF.</p>
  
  <p><strong>UPDATE #2:</strong></p>
  
  <p>See my answer and ultimate solution below.</p>