title: Issue Contacting ADFS Endpoint When on Server
body: <p>I have a service that is setup to retrieve a secure token from ADFS and use that token to communicate with other services.  When I contact my ADFS windowsmixed endpoint from my local development machine hitting the ADFS service I am able to successfuly retrieve the token.  However, when I install my service on the same machine that is running ADFS I receive the following error:</p>
  
  <pre><code> Secure channel cannot be opened because security negotiation with the remote endpoint has failed. This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint.
  </code></pre>
  
  <p>I am able to reproduce the error with the following code that simply gets the token.  Again this code works when I am on my dev machine hitting the remote server, but it fails when on the server directly.  I am using the same user credentials on both.  I get the same error within the IIS web service using the app pool credentials and with a simple test client using the code below.</p>
  
  <pre><code>    private static SecurityToken GetToken()
      {
          string stsEndpoint = "https://adfsserver.com/adfs/services/trust/13/windowsmixed";
           string appliesTo = "http://domain.com/application/myapplication";
  
          var factory = new WSTrustChannelFactory(
              new WindowsWSTrustBinding(SecurityMode.TransportWithMessageCredential),
              stsEndpoint);
          factory.TrustVersion = TrustVersion.WSTrust13;
  
          var rst = new RequestSecurityToken
          {
              RequestType = RequestTypes.Issue,
              AppliesTo = new EndpointAddress(appliesTo),
              KeyType = KeyTypes.Symmetric
          };
  
          var channel = factory.CreateChannel();
          return channel.Issue(rst);
      }
  </code></pre>
  
  <p>I turned on tracing in the Windows Event Log for ADFS 2.0 debug.  When hitting that windowsmixed endpoint directly on the server, I do not receive any entries which leads me to belive that it is not actually getting to the endpoint.</p>
  
  <p>I do receive quite a few audit failures in the security log that are related to the services that I am running:
      A handle to an object was requested.</p>
  
  <pre><code>Subject:
      Security ID:        DOMAIN\ODI$ODIController
      Account Name:       ODI$ODIController
      Account Domain:     DOMAIN
      Logon ID:       0x1a574b5
  
  Object:
      Object Server:      SC Manager
      Object Type:        SERVICE OBJECT
      Object Name:        WinHttpAutoProxySvc
      Handle ID:      0x0
  
  Process Information:
      Process ID:     0x1f8
      Process Name:       C:\Windows\System32\services.exe
  
  Access Request Information:
      Transaction ID:     {00000000-0000-0000-0000-000000000000}
      Accesses:       Query status of service
                  Start the service
                  Query information from service
  
      Access Reasons:     -
      Access Mask:        0x94
      Privileges Used for Access Check:   -
  </code></pre>
  
  <p>I am able to access the usernamemixed endpoint using stored credentials and receive the proper token, so it seems to be something with authenticating the user to even be able to communicate with the ADFS endpoint.</p>
  
  <p>If I set specific credentials in the code above, it is able to connect.  Which again leads me to believe that it is not passing the correct credentials for my Windows user when on the same machine.</p>
  
  <pre><code> factory.Credentials.Windows.ClientCredential = new System.Net.NetworkCredential("UserID", "password1", "dev.domain");
  </code></pre>
  
  <p>Thank you for any assistance you can provide.</p>
  
  <p>Brian</p>