title: Issues connecting BizTalk 2013 WCF to Microsoft CRM 2011 using ADFS
body: <p>I have a Microsoft CRM 2011 instance I'm trying to connect to from BizTalk 2013 using WCF. The CRM instance is using ADFS based security and basic "domain/user" "password" security. The OrganizationService has the following policy in the WSDL.</p>
  
  <pre><code>&lt;wsp:Policy wsu:Id="CustomBinding_IOrganizationService_policy"&gt;
    &lt;wsp:ExactlyOne&gt;
      &lt;wsp:All&gt;
        &lt;ms-xrm:AuthenticationPolicy xmlns:ms-xrm="http://schemas.microsoft.com/xrm/2011/Contracts/Services"&gt;
          &lt;ms-xrm:Authentication&gt;Federation&lt;/ms-xrm:Authentication&gt;
          &lt;ms-xrm:SecureTokenService&gt;
            &lt;ms-xrm:Identifier&gt;http://example.com/adfs/services/trust&lt;/ms-xrm:Identifier&gt;
          &lt;/ms-xrm:SecureTokenService&gt;
        &lt;/ms-xrm:AuthenticationPolicy&gt;
        &lt;sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
          &lt;wsp:Policy&gt;
            &lt;sp:TransportToken&gt;
              &lt;wsp:Policy&gt;
                &lt;sp:HttpsToken/&gt;
              &lt;/wsp:Policy&gt;
            &lt;/sp:TransportToken&gt;
            &lt;sp:AlgorithmSuite&gt;
              &lt;wsp:Policy&gt;
                &lt;sp:Basic256/&gt;
              &lt;/wsp:Policy&gt;
            &lt;/sp:AlgorithmSuite&gt;
            &lt;sp:Layout&gt;
              &lt;wsp:Policy&gt;
                &lt;sp:Strict/&gt;
              &lt;/wsp:Policy&gt;
            &lt;/sp:Layout&gt;
            &lt;sp:IncludeTimestamp/&gt;
          &lt;/wsp:Policy&gt;
        &lt;/sp:TransportBinding&gt;
        &lt;sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
          &lt;wsp:Policy&gt;
            &lt;sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient"&gt;
              &lt;Issuer xmlns="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702"&gt;
                &lt;Address xmlns="http://www.w3.org/2005/08/addressing"&gt;http://www.w3.org/2005/08/addressing/anonymous&lt;/Address&gt;
                &lt;Metadata xmlns="http://www.w3.org/2005/08/addressing"&gt;
                  &lt;Metadata xmlns="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
                    &lt;wsx:MetadataSection xmlns=""&gt;
                      &lt;wsx:MetadataReference&gt;
                        &lt;Address xmlns="http://www.w3.org/2005/08/addressing"&gt;
                          https://example.com/adfs/services/trust/mex
                        &lt;/Address&gt;
                      &lt;/wsx:MetadataReference&gt;
                    &lt;/wsx:MetadataSection&gt;
                  &lt;/Metadata&gt;
                &lt;/Metadata&gt;
              &lt;/Issuer&gt;
              &lt;sp:RequestSecurityTokenTemplate&gt;
                &lt;trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;
                  http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey
                &lt;/trust:KeyType&gt;
                &lt;trust:KeySize xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;256&lt;/trust:KeySize&gt;
                &lt;trust:Claims xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512" Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity"&gt;
                  &lt;wsid:ClaimType xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn"/&gt;
                &lt;/trust:Claims&gt;
                &lt;trust:KeyWrapAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p&lt;/trust:KeyWrapAlgorithm&gt;
                &lt;trust:EncryptWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://www.w3.org/2001/04/xmlenc#aes256-cbc&lt;/trust:EncryptWith&gt;
                &lt;trust:SignWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://www.w3.org/2000/09/xmldsig#hmac-sha1&lt;/trust:SignWith&gt;
                &lt;trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://www.w3.org/2001/10/xml-exc-c14n#&lt;/trust:CanonicalizationAlgorithm&gt;
                &lt;trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512"&gt;http://www.w3.org/2001/04/xmlenc#aes256-cbc&lt;/trust:EncryptionAlgorithm&gt;
              &lt;/sp:RequestSecurityTokenTemplate&gt;
              &lt;wsp:Policy&gt;
                &lt;sp:RequireInternalReference/&gt;
              &lt;/wsp:Policy&gt;
            &lt;/sp:IssuedToken&gt;
          &lt;/wsp:Policy&gt;
        &lt;/sp:EndorsingSupportingTokens&gt;
      &lt;/wsp:All&gt;
    &lt;/wsp:ExactlyOne&gt;
  &lt;/wsp:Policy&gt;
  </code></pre>
  
  <p>I've set up the following client configuration:</p>
  
  <pre><code> &lt;binding name="ws2007FederationHttpBinding"&gt;
     &lt;security mode="TransportWithMessageCredential"&gt;
       &lt;message&gt;
         &lt;issuer address="https://adfs20.example.com/adfs/services/trust/2005/usernamemixed"
         binding="wsHttpBinding" 
         bindingConfiguration="stsBinding" /&gt;
         &lt;issuerMetadata address="https://adfs20.example.com/adfs/services/trust/mex" /&gt;
       &lt;/message&gt;
     &lt;/security&gt;
    &lt;/binding&gt;
  </code></pre>
  
  <p>And referencing this for adfs specific communication</p>
  
  <pre><code>&lt;wsHttpBinding&gt;
    &lt;clear /&gt;
    &lt;binding name="stsBinding"&gt;
      &lt;security mode="TransportWithMessageCredential"&gt;
        &lt;transport clientCredentialType="None"/&gt;
        &lt;message clientCredentialType="UserName" establishSecurityContext="false"/&gt;
      &lt;/security&gt;
     &lt;/binding&gt;
  &lt;/wsHttpBinding&gt;
  </code></pre>
  
  <p>As I try using it I get the receive the following error message </p>
  
  <pre><code>A message sent to adapter "WCF-Custom" on send port "SendPort6" with URI "https://crm-test.example.com/XRMServices/2011/Organization.svc" is suspended. 
   Error details: System.ServiceModel.FaultException: MSIS3127: The specified request failed.
  
  Server stack trace: 
     at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)
     at System.ServiceModel.Security.IssuanceTokenProviderBase`1.GetTokenCore(TimeSpan timeout)
     at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)
     at System.ServiceModel.Security.Tokens.IssuedSecurityTokenProvider.GetTokenCore(TimeSpan timeout)
     at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)
     at System.ServiceModel.Security.SecurityProtocol.TryGetSupportingTokens(SecurityProtocolFactory factory, EndpointAddress target, Uri via, Message message, TimeSpan timeout, Boolean isBlockingCall, IList`1&amp; supportingTokens)
     at System.ServiceModel.Security.TransportSecurityProtocol.SecureOutgoingMessageAtInitiator(Message&amp; message, String actor, TimeSpan timeout)
     at System.ServiceModel.Security.TransportSecurityProtocol.SecureOutgoingMessage(Message&amp; message, TimeSpan timeout)
     at System.ServiceModel.Security.SecurityProtocol.SecureOutgoingMessage(Message&amp; message, TimeSpan timeout, SecurityProtocolCorrelationState correlationState)
     at System.ServiceModel.Channels.SecurityChannelFactory`1.SecurityRequestChannel.Request(Message message, TimeSpan timeout)
     at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation operation, EndpointAddress target, Uri via, SecurityToken currentToken, TimeSpan timeout)
     at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan timeout)
     at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)
     at System.ServiceModel.Security.SecuritySessionClientSettings`1.ClientSecuritySessionChannel.OnOpen(TimeSpan timeout)
     at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
     at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)
     at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)
     at System.ServiceModel.Channels.CommunicationObject.Open()
  
  Exception rethrown at [0]: 
     at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)
     at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)
     at System.ServiceModel.ICommunicationObject.Open()
     at Microsoft.BizTalk.Adapter.Wcf.Runtime.WcfClient`2.GetChannel[TChannel](IBaseMessage bizTalkMessage, ChannelFactory`1&amp; cachedFactory)
     at Microsoft.BizTalk.Adapter.Wcf.Runtime.WcfClient`2.SendMessage(IBaseMessage bizTalkMessage) 
   MessageId:  {0A8D8BB1-0838-43AF-B3A1-D63D432C22AA}
   InstanceID: {B57B4979-2187-4CF7-8115-4D65B3952982}
  </code></pre>
  
  <p>What am I missing?</p>