title: How to get WIF SAML2 Extensions' Saml2AuthenticationModule to work in Windows Azure compute emulator?
body: <p>In IIS Express, using the Saml2AuthenticationModule (from the <a href="http://blogs.msdn.com/b/card/archive/2011/05/16/announcing-the-wif-extension-for-saml-2-0-protocol-community-technology-preview.aspx" rel="nofollow">WIF Extension for SAML2 Protocol</a>) results in the following application flow:</p>
  
  <ol>
  <li>User goes to Service Provider URL that invokes <code>Saml2AuthenticationModule.Current.SignIn</code>(args);</li>
  <li>The module routes a request to the Identity Provider.</li>
  <li>Depending on the SP's AssertionConsumerService metadata, the IdP sends an SSO response back to the SP. In my current tests, this URL is "{rootdomain}/<code>ServiceProvider/saml/post/ac</code>". As far as I can tell, this URL is not configurable.</li>
  <li>The module intercepts this response, does its thing to configure IClaimsIdentity, and then redirects flow back into the SP application (arg passed in step 1). </li>
  </ol>
  
  <p>When targeting the Windows Azure Emulator instead of IIS Express, I changed the web.config to point to a different SP metadata file, with a different AssertionConsumerService that fits with the emulator URL:</p>
  
  <pre><code>&lt;md:AssertionConsumerService index="1" 
      Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST" 
      Location="https://127.0.0.1/ServiceProvider/saml/post/ac" /&gt;
  </code></pre>
  
  <p>When debugging in the azure compute emulator, the flow stops after step #3. When it reaches step #4, I end up looking at a 404 page for this URL:</p>
  
  <pre><code>https://127.0.0.1/ServiceProvider/saml/post/ac
  </code></pre>
  
  <p><strong>What's going on here? Isn't the module supposed to intercept this URL and process the SAML response? Why is this working in IIS Express but not in the azure compute emulator?</strong></p>
  
  <p>Here is the web.config for the SAML stuff:</p>
  
  <pre><code>&lt;system.webServer&gt;
      &lt;validation validateIntegratedModeConfiguration="false" /&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"&gt;
          &lt;add name="Saml2AuthenticationModule" 
              type="Microsoft.IdentityModel.Web.Saml2AuthenticationModule"/&gt;
          &lt;add name="SessionAuthenticationModule" 
              type="Microsoft.IdentityModel.Web.SessionAuthenticationModule"/&gt;
      &lt;/modules&gt;
      ...
  &lt;/system.webServer&gt;
  </code></pre>
  
  <p>...</p>
  
  <pre><code>&lt;microsoft.identityModel&gt;
      &lt;service&gt;
          &lt;audienceUris&gt;
              &lt;add value="https://www.mydomain.com/saml2/development/azure"/&gt;
          &lt;/audienceUris&gt;
          &lt;certificateValidation certificateValidationMode="None"/&gt;
          &lt;issuerNameRegistry type="Microsoft.IdentityModel.Tokens.ConfigurationBasedIssuerNameRegistry"&gt;
              &lt;!-- The set of trusted issuers. --&gt;
              &lt;trustedIssuers&gt;
                  &lt;add name="urn:samples:identityprovider" thumbprint="59 fc 9a da 58 86 31 8d 1d d5 f8 a6 0f 9a 53 f8 09 fc 0e 63"/&gt;
              &lt;/trustedIssuers&gt;
          &lt;/issuerNameRegistry&gt;
          &lt;serviceTokenResolver type="Samples.Saml.Utilities.SampleServiceProviderSecurityTokenResolver"/&gt;
          &lt;!-- Enable saveBootstrapTokens so the token visualizer can show the raw SAML assertion. --&gt;
          &lt;securityTokenHandlers&gt;
              &lt;securityTokenHandlerConfiguration saveBootstrapTokens="true"&gt;
              &lt;/securityTokenHandlerConfiguration&gt;
          &lt;/securityTokenHandlers&gt;
          &lt;federatedAuthentication&gt;
              &lt;cookieHandler requireSsl="true"/&gt;
          &lt;/federatedAuthentication&gt;
      &lt;/service&gt;
  &lt;/microsoft.identityModel&gt;
  </code></pre>
  
  <p>...</p>
  
  <pre><code>&lt;microsoft.identityModel.saml metadata="saml2-azure.xml"&gt;
      &lt;identityProviders&gt;
          &lt;metadata file="identityprovider.xml"/&gt;
      &lt;/identityProviders&gt;
  &lt;/microsoft.identityModel.saml&gt;
  </code></pre>
  
  <p>The entityID in saml2-azure is <code>https://www.mydomain.com/saml2/development/azure</code>, has the above AssertionConsumerService URL, and is in both the SP and IdP under test. </p>