title: Owin Authentication WS-Federation Fails Due To SecurityTokenHandlers
body: <p>I'm trying to authenticate toward an ACS server using OWIN in MVC 5. My process is based off an authentication with http modules the old way through the config files but I can't get it to work with OWIN and get this error:</p>
  <blockquote>
  <p>IDX10201: None of the SecurityTokenHandlers could read the 'securityToken'</p>
  </blockquote>
  <p>Here are the relevant parts of my startup:</p>
  <pre><code>        app.UseCookieAuthentication(
              new CookieAuthenticationOptions
              {
                  AuthenticationType =
                      WsFederationAuthenticationDefaults.AuthenticationType
              });
  app.UseWsFederationAuthentication(
              new WsFederationAuthenticationOptions
              {
                  MetadataAddress =
                      &quot;https://*******.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml&quot;,
                  Wtrealm = &quot;http://localhost:62569/&quot;,
                  Wreply = &quot;http://localhost:62569/callback-signin&quot;,
                  SecurityTokenHandlers = new SecurityTokenHandlerCollection
                  {
                      new MachineKeySessionSecurityTokenHandler
                      {
                          Configuration = new SecurityTokenHandlerConfiguration
                          {
                              CertificateValidationMode = X509CertificateValidationMode.None,
                              IssuerNameRegistry = new ValidatingIssuerNameRegistry
                              {
                                  IssuingAuthorities =
                                      new List&lt;IssuingAuthority&gt;
                                      {
                                          new IssuingAuthority(&quot;https://*******.accesscontrol.windows.net/&quot;)
                                          {
                                              Thumbprints = { &quot;9B9F8B5E21640ED692C*****A62B4077813659B5&quot; },
                                              Issuers = { &quot;https://*******.accesscontrol.windows.net/&quot; }
                                          }
                                      }
                              }
                          }
                      }
                  }
              });
  </code></pre>
  <p>And here is the working config file</p>
  <pre><code>&lt;?xml version=&quot;1.0&quot; encoding=&quot;utf-8&quot;?&gt;
  &lt;!--
    For more information on how to configure your ASP.NET application, please visit
    http://go.microsoft.com/fwlink/?LinkId=301880
    --&gt;
  &lt;configuration&gt;
    &lt;configSections&gt;
      &lt;section name=&quot;entityFramework&quot; type=&quot;System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089&quot; requirePermission=&quot;false&quot; /&gt;    
      &lt;section name=&quot;system.identityModel&quot; type=&quot;System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089&quot; /&gt;
      &lt;section name=&quot;system.identityModel.services&quot; type=&quot;System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089&quot; /&gt;
    &lt;/configSections&gt;
    &lt;connectionStrings&gt;
      &lt;add name=&quot;DefaultConnection&quot; connectionString=&quot;Data Source=********.database.windows.net,1433;Initial Catalog=*********;Persist Security Info=True;User ID=m*******;Password=*******&quot; providerName=&quot;System.Data.SqlClient&quot; /&gt;
    &lt;/connectionStrings&gt;
    &lt;appSettings&gt;
      &lt;add key=&quot;webpages:Version&quot; value=&quot;3.0.0.0&quot; /&gt;
      &lt;add key=&quot;webpages:Enabled&quot; value=&quot;false&quot; /&gt;
      &lt;add key=&quot;ClientValidationEnabled&quot; value=&quot;true&quot; /&gt;
      &lt;add key=&quot;UnobtrusiveJavaScriptEnabled&quot; value=&quot;true&quot; /&gt;
    &lt;/appSettings&gt;
  
    &lt;system.web&gt;
      &lt;authentication mode=&quot;None&quot; /&gt;
      &lt;compilation debug=&quot;true&quot; targetFramework=&quot;4.5.2&quot; /&gt;
      &lt;httpRuntime targetFramework=&quot;4.5&quot; /&gt;
    &lt;/system.web&gt;
    
    
    
    &lt;system.webServer&gt;
      &lt;modules&gt;
        &lt;add name=&quot;WSFederationAuthenticationModule&quot; type=&quot;System.IdentityModel.Services.WSFederationAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089&quot; preCondition=&quot;managedHandler&quot; /&gt;
        &lt;add name=&quot;SessionAuthenticationModule&quot; type=&quot;System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089&quot; preCondition=&quot;managedHandler&quot; /&gt;
      &lt;/modules&gt;
      &lt;handlers&gt;
        &lt;remove name=&quot;ExtensionlessUrlHandler-Integrated-4.0&quot; /&gt;
        &lt;remove name=&quot;OPTIONSVerbHandler&quot; /&gt;
        &lt;remove name=&quot;TRACEVerbHandler&quot; /&gt;
        &lt;add name=&quot;ExtensionlessUrlHandler-Integrated-4.0&quot; path=&quot;*.&quot; verb=&quot;*&quot; type=&quot;System.Web.Handlers.TransferRequestHandler&quot; preCondition=&quot;integratedMode,runtimeVersionv4.0&quot; /&gt;
      &lt;/handlers&gt;
    &lt;/system.webServer&gt;
  
  
   &lt;system.identityModel&gt;
      &lt;identityConfiguration&gt;
        &lt;audienceUris&gt;
          &lt;add value=&quot;http://localhost:62569&quot; /&gt;
        &lt;/audienceUris&gt;
        &lt;securityTokenHandlers&gt;
          &lt;add type=&quot;System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089&quot; /&gt;
          &lt;remove type=&quot;System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089&quot; /&gt;
        &lt;/securityTokenHandlers&gt;
        &lt;certificateValidation certificateValidationMode=&quot;None&quot; /&gt;
        &lt;issuerNameRegistry type=&quot;System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry&quot;&gt;
          &lt;authority name=&quot;https://**********.accesscontrol.windows.net/&quot;&gt;
            &lt;keys&gt;
              &lt;add thumbprint=&quot;9B9F8B5E21640ED692CC1CF2A62B4077813659B5&quot; /&gt;
            &lt;/keys&gt;
            &lt;validIssuers&gt;
              &lt;add name=&quot;https://*********.accesscontrol.windows.net/&quot; /&gt;
            &lt;/validIssuers&gt;
          &lt;/authority&gt;
        &lt;/issuerNameRegistry&gt;
      &lt;/identityConfiguration&gt;
    &lt;/system.identityModel&gt;
    &lt;system.identityModel.services&gt;
      &lt;federationConfiguration&gt;
        &lt;cookieHandler requireSsl=&quot;false&quot; /&gt;
        &lt;wsFederation passiveRedirectEnabled=&quot;true&quot; issuer=&quot;https://***********.accesscontrol.windows.net/v2/wsfederation&quot; realm=&quot;http://localhost:62569&quot; reply=&quot;http://localhost:62569/callback-signin&quot; requireHttps=&quot;false&quot; /&gt;
      &lt;/federationConfiguration&gt;
    &lt;/system.identityModel.services&gt;      
    
        &lt;entityFramework&gt;
          &lt;providers&gt;
            &lt;provider invariantName=&quot;System.Data.SqlClient&quot; type=&quot;System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer&quot; /&gt;
          &lt;/providers&gt;
          &lt;defaultConnectionFactory type=&quot;System.Data.Entity.Infrastructure.LocalDbConnectionFactory, EntityFramework&quot;&gt;
            &lt;parameters&gt;
              &lt;parameter value=&quot;Data Source=***********.database.windows.net,1433;Initial Catalog=********;Persist Security Info=True;User ID=*************;Password=********&quot; /&gt;
            &lt;/parameters&gt;
          &lt;/defaultConnectionFactory&gt;
        &lt;/entityFramework&gt;
        
      &lt;/configuration&gt;
  </code></pre>
  <p><strong>Full Owin Errors</strong></p>
  <blockquote>
  <p>'System.IdentityModel.Tokens.SecurityTokenValidationException' in
  mscorlib.dll</p>
  <p>Additional information: IDX10201: None of the the
  SecurityTokenHandlers could read the 'securityToken':</p>
  </blockquote>
  <pre><code>    &lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;
  &lt;Assertion xmlns=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot; ID=&quot;_19fb92df-c8ac-4388-9294-7a8cdb3bcf0b&quot; IssueInstant=&quot;2015-07-30T12:07:25.837Z&quot; Version=&quot;2.0&quot;&gt;
     &lt;Issuer&gt;https://*********.accesscontrol.windows.net/&lt;/Issuer&gt;
     &lt;ds:Signature xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;
        &lt;ds:SignedInfo&gt;
           &lt;ds:CanonicalizationMethod Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot; /&gt;
           &lt;ds:SignatureMethod Algorithm=&quot;http://www.w3.org/2001/04/xmldsig-more#rsa-sha256&quot; /&gt;
           &lt;ds:Reference URI=&quot;#_19fb92df-c8ac-4388-9294-7a8cdb3bcf0b&quot;&gt;
              &lt;ds:Transforms&gt;
                 &lt;ds:Transform Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot; /&gt;
                 &lt;ds:Transform Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot; /&gt;
              &lt;/ds:Transforms&gt;
              &lt;ds:DigestMethod Algorithm=&quot;http://www.w3.org/2001/04/xmlenc#sha256&quot; /&gt;
              &lt;ds:DigestValue&gt;wEjAPR2kWtfrRKX9tMGvJu/Nv+yLtm1KeXbYFDwbB8U=&lt;/ds:DigestValue&gt;
           &lt;/ds:Reference&gt;
        &lt;/ds:SignedInfo&gt;
        &lt;ds:SignatureValue&gt;GVamldoBjB+RZY+2bf2700k2Z4PUtp+7Cy9EGTne5+7ID+tLmQ08yXur898O21ldqVqqmGxKbVYQRPVRkF1F+e3bBRipEhyvZ4K8oxQly6f0lLza2svTBSI8GUhLQ9/5ElReaOAgM84q3V5XcBvmXHamanRFSd5hzkTqWbRlNFWJFisqKEuTBTl2DLNV/CeWKrv+11qTgGc0Qxk18mycDGXDfwuWAYcVAZMImiEFm8wErIfOaQ9EbKYqtoVdbuKb5WH2+yjI6jp7uHRKl6x2z77XVLuNRLbutgQDASMGt2dll4P7Ve/tt/NqzkHj7P/zbkEYckY6r1W2Tv1kUeh6vg==&lt;/ds:SignatureValue&gt;
        &lt;KeyInfo xmlns=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;
           &lt;X509Data&gt;
              &lt;X509Certificate&gt;MIIDSjCCAjagAwIBAgIQrcBhMtovuJ9MilbEjMjS7TAJBgUrDgMCHQUAMDExLzAtBgNVBAMTJm1hcmdvY29uc2VpbC5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTE1MDYxNjA4MTYzOFoXDTIwMDUzMTIyMDAwMFowMTEvMC0GA1UEAxMmbWFyZ29jb25zZWlsLmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpeZseXX1IYTABUOPr7nfIAXc7cXAI0k+vR3qEbvy0UxEhYAkAocQR2qUTPQ8D1v4lPp59tnHKBGJ0eHt9DYm/SyKkfHsWfqsysZx5NHXSJIhy/SgHwpd8b2q1NKxqBRLrdJKyAua+WWza4p/HMFjEVoN/upZtngSqxUKO/oYqy6m7smkz8vwjzpJR8tyqN881XBQzvryiF/i3ZPFQqlCT9263TMcAGPpym9uvxHzFPPx3u8IDz3AQydyHeViaJhiXGic0VEcm6LMn3JLOYqAzJnv8z89NdpsL4ynv1ekytt/8yyza3CnsU1E4tFDj1HU3785aFZ1xm6wr1MUK9VOTAgMBAAGjZjBkMGIGA1UdAQRbMFmAEN1alzwM3lJSHdh4LFl7uxmhMzAxMS8wLQYDVQQDEyZtYXJnb2NvbnNlaWwuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldIIQrcBhMtovuJ9MilbEjMjS7TAJBgUrDgMCHQUAA4IBAQAsQ5jNKvS2fLtqs9oB6DGTXdI5nAli5UyvZUQlnf******ifG14SRbVdTjUOzngIWAJ5KAQk5t//wSkwgAS+U6AFYI/mee9NLEvOEhrRbpGUP0oL504OZ9zTDeXmGu2FybRB2TvdTKLaeVsBvwqgP33QFkcuPK50fCGC1l3SecIeyWL5fsiw/2+GuTKHjCaeRqnYBgDTINptc9PGayLPBTjs4UPzbccmaYyuanmTAMZGU0iRoGJYet2uAasT52QvWZqD0NUZbWyR1N8CBf5EIW2S/TrpoOBYNgZQU5n9PRJjTBhESHXjfa8RipC8RXU9o&lt;/X509Certificate&gt;
           &lt;/X509Data&gt;
        &lt;/KeyInfo&gt;
     &lt;/ds:Signature&gt;
     &lt;Subject&gt;
        &lt;NameID&gt;******.*******@********.net&lt;/NameID&gt;
        &lt;SubjectConfirmation Method=&quot;urn:oasis:names:tc:SAML:2.0:cm:bearer&quot; /&gt;
     &lt;/Subject&gt;
     &lt;Conditions NotBefore=&quot;2015-07-30T12:07:25.837Z&quot; NotOnOrAfter=&quot;2015-07-30T13:07:25.837Z&quot;&gt;
        &lt;AudienceRestriction&gt;
           &lt;Audience&gt;http://localhost:62569/&lt;/Audience&gt;
        &lt;/AudienceRestriction&gt;
     &lt;/Conditions&gt;
     &lt;AttributeStatement&gt;
        &lt;Attribute Name=&quot;http://schemas.microsoft.com/identity/claims/tenantid&quot;&gt;
           &lt;AttributeValue&gt;7102feaa-34af-4756-85ce-b0f69766d78d&lt;/AttributeValue&gt;
        &lt;/Attribute&gt;
        &lt;Attribute Name=&quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name&quot;&gt;
           &lt;AttributeValue&gt;*****.*******@*******.net&lt;/AttributeValue&gt;
        &lt;/Attribute&gt;
        &lt;Attribute Name=&quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname&quot;&gt;
           &lt;AttributeValue&gt;******&lt;/AttributeValue&gt;
        &lt;/Attribute&gt;
        &lt;Attribute Name=&quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname&quot;&gt;
           &lt;AttributeValue&gt;*******&lt;/AttributeValue&gt;
        &lt;/Attribute&gt;
        &lt;Attribute Name=&quot;http://schemas.microsoft.com/identity/claims/identityprovider&quot;&gt;
           &lt;AttributeValue&gt;https://sts.windows.net/7102feaa-34af-4756-85ce-b0f69766d78d/&lt;/AttributeValue&gt;
        &lt;/Attribute&gt;
        &lt;Attribute Name=&quot;http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider&quot;&gt;
           &lt;AttributeValue&gt;https://sts.windows.net/7102feaa-34af-4756-85ce-b0f69766d78d/&lt;/AttributeValue&gt;
        &lt;/Attribute&gt;
     &lt;/AttributeStatement&gt;
     &lt;AuthnStatement AuthnInstant=&quot;2015-07-27T12:39:30.003Z&quot;&gt;
        &lt;AuthnContext&gt;
           &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/AuthnContextClassRef&gt;
        &lt;/AuthnContext&gt;
     &lt;/AuthnStatement&gt;
  &lt;/Assertion&gt;
  </code></pre>