title: Website authenticated by Session Security Token, need to pass it to WCF service
body: <p>I have a simple .NET 4.5 MVC website. Upon login, a <code>ClaimsPrincipal</code> is created with some test claims:</p>
  
  <pre><code>List&lt;Claim&gt; claims = new List&lt;Claim&gt;();
  claims.Add(new Claim("Test", "Test"));
  claims.Add(new Claim(ClaimTypes.NameIdentifier, "nameid"));
  var id = new ClaimsIdentity(claims, "Forms");
  var cp = new ClaimsPrincipal(id);
  
  var token = new SessionSecurityToken(cp);
  FederatedAuthentication.SessionAuthenticationModule.WriteSessionTokenToCookie(token);
  </code></pre>
  
  <p>The <code>web.config</code> to get that working is:</p>
  
  <pre><code>&lt;!-- (have snipped out standard, not interesting web.config) --&gt;
  &lt;configSections&gt;
       &lt;section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
       &lt;section name="system.identityModel.services" type="System.IdentityModel.Services.Configuration.SystemIdentityModelServicesSection, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" /&gt;
  
  &lt;system.webServer&gt;
       &lt;modules runAllManagedModulesForAllRequests="true"&gt;
       &lt;remove name="FormsAuthenticationModule" /&gt;
       &lt;add name="SessionAuthenticationModule" type="System.IdentityModel.Services.SessionAuthenticationModule, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" preCondition="managedHandler" /&gt;
  
  &lt;system.identityModel.services&gt;
       &lt;federationConfiguration&gt;
       &lt;cookieHandler requireSsl="false" persistentSessionLifetime="2"/&gt;
  </code></pre>
  
  <p>From elsewhere in the web application, I can get at the claims using <code>ClaimsPrincipal.Current</code>.</p>
  
  <h2>Sending to WCF Service</h2>
  
  <p>I need to send these claims to a friendly WCF service (intranet only). As you can see from above, the token is created in a web application, not on an STS. I want to be able to pass that token to the WCF service and have the service set it as ClaimsPrincipal.</p>
  
  <p>The service looks like:</p>
  
  <pre><code>// IClaimsCheckService
  [ServiceContract]
  public interface IClaimsCheckService
  {
      [OperationContract]
      void CheckClaims();
  
  // ClaimsCheckService.svc
  public class ClaimsCheckService : IClaimsCheckService
  {
      public void CheckClaims()
      {
          var claimsPrincipal = ClaimsPrincipal.Current;
      }
  }
  </code></pre>
  
  <p>The server <code>web.config</code> is:
      
          
          </p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
      &lt;behaviors&gt;
         &lt;serviceBehaviors&gt;
            &lt;behavior&gt;
               &lt;serviceAuthorization principalPermissionMode="Always"  /&gt;
               &lt;serviceCredentials useIdentityConfiguration="true" /&gt;
               &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/&gt;
               &lt;serviceDebug includeExceptionDetailInFaults="false"/&gt;
  </code></pre>
  
  <p>The <code>web.config</code> for the client - which is the MVC website described above and this config is the rest of the config from the snippet above.</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;behaviors&gt;
          &lt;endpointBehaviors&gt;
              &lt;behavior&gt;
                   &lt;clientCredentials useIdentityConfiguration="true"&gt;
                        &lt;serviceCertificate&gt;
                            &lt;authentication certificateValidationMode="None"/&gt;
                        &lt;/serviceCertificate&gt;
                   &lt;/clientCredentials&gt;
              &lt;/behavior&gt;
          &lt;/endpointBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
          &lt;basicHttpBinding&gt;
              &lt;binding name="BasicHttpBinding_IClaimsCheckService" /&gt;
          &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint address="http://localhost:59343/ClaimsCheckService.svc"
              binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IClaimsCheckService"
              contract="CCS.IClaimsCheckService" name="BasicHttpBinding_IClaimsCheckService" /&gt;
      &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>I've read through Dominick Baier's excellent series on <a href="http://leastprivilege.com/2012/07/15/wcf-and-identity-in-net-4-5-overview/" rel="nofollow">WCF and Identity in .NET 4.5</a>. I've also read through the dense <a href="http://msdn.microsoft.com/en-us/magazine/ee335707.aspx" rel="nofollow">MSDN article on Claims based authorization.</a> Unlike other questions, I am not using an STS but creating the federated token in the website.</p>
  
  <h2>What I am expecting</h2>
  
  <p>When the service is called, I expect the WCF client to send the Principal in the client thread to the WCF service so that when I perform <code>var claimsPrincipal = ClaimsPrincipal.Current;</code> on the server, I get the same Principal.</p>
  
  <h2>What happens</h2>
  
  <p>The <code>ClaimsPrincipal.Current</code> is empty (new) and does not contain any information from the client.</p>
  
  <p>I have a feeling that creating my own token won't work because the WCF service has no way of decoding it back into claims. Also, I fear that I cannot use basicHttpBinding with no security.</p>
  
  <p>Thank you in advance! </p>