title: OWIN Authentication Pipeline To Use Katana Middleware Correctly?
body: <p>I'm looking to use WsFederation Authentication against an internal ADFS 2 service and to use the OWIN authentication pipeline .</p>
  <p>What is considered to be the order in which middleware should be hooked up and which modules are required in various scenarios with minimal code?</p>
  <hr />
  <p>For example, it would appear that <code>UseWsFederationAuthentication</code> should be used in conjunction with <code>UseCookieAuthentication</code>, but I'm not sure what the correct <code>AuthenticationType</code> would be (<a href="http://benfoster.io/blog/aspnet-identity-stripped-bare-mvc-part-1" rel="nofollow noreferrer">this</a> post suggests that it's just an identifier string, but is it's value significant?) or even if we still need to use <code>SetDefaultSignInAsAuthenticationType</code>.</p>
  <p>I also noticed <a href="http://katanaproject.codeplex.com/discussions/547633" rel="nofollow noreferrer">this</a> thread on the Katana Project discussions board, where Tratcher mentions a common mistake, but isn't very specific as to which part of the code is in error.</p>
  <p>The following (<em>with a custom SAML Token handler to read the token string into a valid XML document</em>), works, but is it optimal?</p>
  <pre><code>var appURI = ConfigurationManager.AppSettings[&quot;app:URI&quot;];
  var fedPassiveTokenEndpoint = ConfigurationManager.AppSettings[&quot;wsFederation:PassiveTokenEndpoint&quot;];
  var fedIssuerURI = ConfigurationManager.AppSettings[&quot;wsFederation:IssuerURI&quot;];
  var fedCertificateThumbprint = ConfigurationManager.AppSettings[&quot;wsFederation:CertificateThumbprint&quot;];
  
  var audienceRestriction = new AudienceRestriction(AudienceUriMode.Always);
  
  audienceRestriction.AllowedAudienceUris.Add(new Uri(appURI));
  
  var issuerRegistry = new ConfigurationBasedIssuerNameRegistry();
  
  issuerRegistry.AddTrustedIssuer(fedCertificateThumbprint, fedIssuerURI);
  
  app.UseCookieAuthentication(
      new CookieAuthenticationOptions
      {
          AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType // &quot;Federation&quot;
      }
  );
  
  app.UseWsFederationAuthentication(
      new WsFederationAuthenticationOptions
      {
          Wtrealm = appURI,
          SignOutWreply = appURI,
          Configuration = new WsFederationConfiguration
          {
              TokenEndpoint = fedPassiveTokenEndpoint
          },
          TokenValidationParameters = new TokenValidationParameters
          {
              AuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType
          },
          SecurityTokenHandlers = new SecurityTokenHandlerCollection
          {                        
              new SamlSecurityTokenHandlerEx
              {
                  CertificateValidator = X509CertificateValidator.None,
                  Configuration = new SecurityTokenHandlerConfiguration
                  {
                      AudienceRestriction = audienceRestriction,
                      IssuerNameRegistry = issuerRegistry
                  }
              }
          }
      }
  );
  </code></pre>