title: WCF error calling WS-Security web service: Cannot find a token authenticator for the X509SecurityToken
body: <p>I'm trying to connect with an external Java Web service with WS-Security enabled over https with a WCF client. 
  The service use UserNameToken authentication.</p>
  
  <p>When the client call the service, I get this exception:<br />
  <strong>Cannot find a token authenticator for the 'System.IdentityModel.Tokens.X509SecurityToken' token type. Tokens of that type cannot be accepted according to current security settings.</strong></p>
  
  <p>I use a custom binding with this configuration:<br />
  <br />The endpoint:</p>
  
  <pre><code>&lt;endpoint address="https://des-afirma.redsara.es/afirmaws/services/ValidarFirma"
            binding="customBinding" bindingConfiguration="ValidarFirmaBinding"
            contract="AFirma.Firma" name="ValidarFirma" /&gt;
  &lt;/endpoint&gt;
  </code></pre>
  
  <p>The binding:</p>
  
  <pre><code>&lt;binding name="ValidarFirmaBinding"&gt;
      &lt;textMessageEncoding messageVersion="Soap11" /&gt;
      &lt;security  
          allowSerializedSigningTokenOnReply="true" 
          authenticationMode="UserNameOverTransport"&gt;
          &lt;secureConversationBootstrap /&gt;
      &lt;/security&gt;
      &lt;httpsTransport&gt;
          &lt;extendedProtectionPolicy policyEnforcement="Never" /&gt;
      &lt;/httpsTransport&gt;
  &lt;/binding&gt;
  </code></pre>
  
  <p>I read this link <a href="http://webservices20.blogspot.co.uk/2010/10/wcf-cannot-find-token-authenticator.html" rel="nofollow">http://webservices20.blogspot.co.uk/2010/10/wcf-cannot-find-token-authenticator.html</a> and I configured the allowSerializedSigningTokenOnReply value, but it failed.</p>
  
  <p>This is the message generated by WCF:<br /></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:wsa="http://schemas.xmlsoap.org/ws/2004/08/addressing" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;
     &lt;soap:Header&gt;
        &lt;wsa:Action /&gt;
        &lt;wsa:MessageID&gt;urn:uuid:5b36bb8b-4a59-4c5f-9c67-065543db51d5&lt;/wsa:MessageID&gt;
        &lt;wsa:ReplyTo&gt;
           &lt;wsa:Address&gt;http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous&lt;/wsa:Address&gt;
        &lt;/wsa:ReplyTo&gt;
        &lt;wsa:To&gt;http://des-afirma.redsara.es/afirmaws/services/ValidarFirma&lt;/wsa:To&gt;
        &lt;wsse:Security soap:mustUnderstand="1"&gt;
           &lt;wsu:Timestamp wsu:Id="Timestamp-cef53b94-4432-4ede-89ea-7a42b7a686d2"&gt;
              &lt;wsu:Created&gt;2012-11-13T13:49:32Z&lt;/wsu:Created&gt;
              &lt;wsu:Expires&gt;2012-11-13T13:54:32Z&lt;/wsu:Expires&gt;
           &lt;/wsu:Timestamp&gt;
           &lt;wsse:UsernameToken wsu:Id="SecurityToken-40deaa3d-fe02-4462-963e-7705e4648b24"&gt;
              &lt;wsse:Username&gt;UserName&lt;/wsse:Username&gt;
              &lt;wsse:Password Type="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordDigest"&gt;[Password]&lt;/wsse:Password&gt;
              &lt;wsse:Nonce&gt;G5CU1R6lKSTpBQ0FAF01rA==&lt;/wsse:Nonce&gt;
              &lt;wsu:Created&gt;2012-11-13T13:49:32Z&lt;/wsu:Created&gt;
           &lt;/wsse:UsernameToken&gt;
        &lt;/wsse:Security&gt;
     &lt;/soap:Header&gt;
     &lt;soap:Body&gt;
        &lt;ValidarFirma xmlns="http://afirmaws/services/ValidarFirma"&gt;
           &lt;paramIn xmlns=""&gt;[Param value (XML String)]&lt;/paramIn&gt;
        &lt;/ValidarFirma&gt;
     &lt;/soap:Body&gt;
  &lt;/soap:Envelope&gt;
  </code></pre>
  
  <p>And this is the response:<br /></p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"&gt;
    &lt;soapenv:Header&gt;
      &lt;wsse:Security soapenv:actor="http://schemas.xmlsoap.org/soap/actor/next" soapenv:mustUnderstand="0"&gt;
        &lt;wsse:BinarySecurityToken EncodingType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-soap-message-security-1.0#Base64Binary" ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" wsu:Id="binaryToken"&gt;
          MIIG2TCCBcGgAwIBAgIISXHqSo0f+C0wDQYJKoZIhvcNAQEFBQAwUjERMA8GA1UEAxMIQUNDVi1D
          [...]
        &lt;/wsse:BinarySecurityToken&gt;
        &lt;Signature xmlns="http://www.w3.org/2000/09/xmldsig#" Id="Signature-BDFADICIJJIDI81"&gt;
          &lt;SignedInfo&gt;
            &lt;CanonicalizationMethod Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" /&gt;
            &lt;SignatureMethod Algorithm="http://www.w3.org/2000/09/xmldsig#rsa-sha1" /&gt;
            &lt;Reference URI="#SignedBody-BDFADICIJJIDI81"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;TFKLyv9zd1G7RXK4sJV+hG2WfqQ=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#keyInfo-BDFADICIJJIDI81"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;SWO3sIcC16EcT17pBREoGe3CVes=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
            &lt;Reference URI="#binaryToken"&gt;
              &lt;Transforms&gt;
                &lt;Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#WithComments" /&gt;
              &lt;/Transforms&gt;
              &lt;DigestMethod Algorithm="http://www.w3.org/2000/09/xmldsig#sha1" /&gt;
              &lt;DigestValue&gt;GT+8/UoUzQgUAhvc25bn+DL6T1E=&lt;/DigestValue&gt;
            &lt;/Reference&gt;
          &lt;/SignedInfo&gt;
          &lt;SignatureValue Id="SignatureValue-BDFADICIJJIDI81"&gt;
            sTVgtvYlVuwhQ9XGcTfHh7lKdUcsf8vF6vyJ/5LVxuwarRDAjMzHcQlvFBlZTn8f
            [..]
          &lt;/SignatureValue&gt;
          &lt;KeyInfo Id="keyInfo-BDFADICIJJIDI81"&gt;
            &lt;KeyValue&gt;
              &lt;RSAKeyValue&gt;
                &lt;Modulus&gt;
                  tCxb/yk9DgCJmdxshvm6RwQtRMHqTdI2nDzQ2C761KEGmAaz7jrv8PtVSoNMRVr9
                  [...]
                &lt;/Modulus&gt;
                &lt;Exponent&gt;AQAB&lt;/Exponent&gt;
              &lt;/RSAKeyValue&gt;
            &lt;/KeyValue&gt;
            &lt;X509Data&gt;
              &lt;X509Certificate&gt;
                MIIG2TCCBcGgAwIBAgIISXHqSo0f+C0wDQYJKoZIhvcNAQEFBQAwUjERMA8GA1UE
                [...]
              &lt;/X509Certificate&gt;
              &lt;X509IssuerSerial&gt;
                &lt;X509IssuerName&gt;Certificate name&lt;/X509IssuerName&gt;
                &lt;X509SerialNumber&gt;Serial number&lt;/X509SerialNumber&gt;
              &lt;/X509IssuerSerial&gt;
            &lt;/X509Data&gt;
            &lt;wsse:SecurityTokenReference xmlns="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd"&gt;
              &lt;wsse:Reference URI="#binaryToken" /&gt;
            &lt;/wsse:SecurityTokenReference&gt;
          &lt;/KeyInfo&gt;
        &lt;/Signature&gt;
      &lt;/wsse:Security&gt;
    &lt;/soapenv:Header&gt;
    &lt;soapenv:Body wsu:Id="SignedBody-BDFADICIJJIDI81"&gt;
      &lt;ValidarFirmaResponse xmlns="http://afirmaws/services/ValidarFirma"&gt;
        &lt;ValidarFirmaReturn xmlns="" xsi:type="c0bxsd:string"&gt;
            [return value (XML String)]
        &lt;/ValidarFirmaReturn&gt;
      &lt;/ValidarFirmaResponse&gt;
    &lt;/soapenv:Body&gt;
  &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>I tried the web service with WSE 3.0 and it works, but I can't install the package in the server because it is Windows Server 2008 and the installation failed.</p>