title: WCF STS Token Expiration Problem
body: <p>I have a WCF service (FooService) protected by Secure Conversation. Also have an STS (StsService) that provides tokens to clients calling FooService. The tokens are good for 15 minutes. The STS is custom-build (no Geneva). The client also has some custom WCF extensions to allow re-use of the token across several services during the lifetime of the client.</p>
  
  <p>The client requests a token from the STS when "Open" on the channel to FooService is called. The STS works fine, issues the token and provides a valid RSTR back to the client. The client receives the de-serialized token (as a <code>GenericXmlSecurityToken</code> object).</p>
  
  <p><strong>Problem:</strong></p>
  
  <p>When the client receives the <code>GenericXmlSecurityToken</code> instance, the expiration date is NOT set correctly. In the RSTR, there is a SAML tag <code>&lt;saml:Conditions&gt;</code> which has the valid expiration date BUT, for some reason, WCF does not seem to be parsing the tag and using the value of <code>NotOnOrAfter</code>.</p>
  
  <p>Here is the binding for the STS (server-side):</p>
  
  <pre><code>    &lt;binding name="stsBinding" receiveTimeout="infinite" 
  sendTimeout="infinite"&gt;
        &lt;security authenticationMode="SecureConversation" requireSecurityContextCancellation="true"&gt;
          &lt;localClientSettings maxClockSkew="23:59:59" /&gt;
          &lt;localServiceSettings maxClockSkew="23:59:59" 
  inactivityTimeout="00:02:00" /&gt;
          &lt;secureConversationBootstrap 
  authenticationMode="UserNameForSslNegotiated"&gt;
            &lt;localClientSettings maxClockSkew="23:59:59" /&gt;
            &lt;localServiceSettings maxClockSkew="23:59:59" /&gt;
          &lt;/secureConversationBootstrap&gt;
        &lt;/security&gt;
        &lt;binaryMessageEncoding /&gt;
  </code></pre>
  
  <p>Here is the client-side binding:</p>
  
  <pre><code>&lt;binding name="stsBinding"
       closeTimeout="00:02:00"
       openTimeout="00:02:00"
       sendTimeout="00:02:00"&gt;
        &lt;security authenticationMode="SecureConversation" requireSecurityContextCancellation="true"&gt;
          &lt;localClientSettings maxClockSkew="23:59:59" /&gt;
          &lt;localServiceSettings maxClockSkew="23:59:59" 
  inactivityTimeout="00:02:00" /&gt;
          &lt;secureConversationBootstrap 
  authenticationMode="UserNameForSslNegotiated"&gt;
            &lt;localClientSettings maxClockSkew="23:59:59" /&gt;
        &lt;localServiceSettings maxClockSkew="23:59:59" /&gt;
      &lt;/secureConversationBootstrap&gt;
    &lt;/security&gt;
    &lt;binaryMessageEncoding /&gt;
    &lt;tcpTransport maxReceivedMessageSize="2097152"
                  maxBufferSize="2097152" maxPendingConnections="10"
                  listenBacklog="10" /&gt;
  &lt;/binding&gt;
  </code></pre>
  
  <p>I have tried several things to get the correct expiration date to show-up... but nothings seems to work. Tried implementing a custom Serializer. Could not find any trace of <code>&lt;saml:Conditions&gt;</code>.  Also tried calling the STS directly, then providing the token back to WCF. That solution worked, calling the STS directly and de-serializing the response into a valid SecurityToken, but when it is provided back to WCF, the "Open" call on the channel times-out after 2 mintues. No error message, nothing in the trace log...</p>
  
  <p>On the client-side, the token has the SAML assertion. If I look at: <code>((GenericXmlSecurityToken)token).TokenXml.InnerXml</code>, this is what I see:</p>
  
  <pre><code>&lt;saml:Conditions 
  NotBefore="2009-09-01T19:36:54.669Z" 
  NotOnOrAfter="2009-09-01T19:41:54.669Z" 
  xmlns:saml="urn:oasis:names:tc:SAML:1.0:assertion"&gt;
  &lt;/saml:Conditions&gt;
  </code></pre>
  
  <p>Even tried stepping through the .NET Framework source, but cannot do that with VS 2008 SP1 on Windows 7. DOES NOT WORK! Arg!</p>
  
  <p>Any ideas?</p>