title: WCF error: Cannot find a token authenticator
body: <p>i need to consume WCF service over SSL while the request needs to be sign with one certificate and the response needs to be validated with another certificate.</p>
  
  <p>i get this error while executing the code:</p>
  
  <blockquote>
    <p>Cannot find a token authenticator for the 'System.IdentityModel.Tokens.X509SecurityToken' token type. Tokens of that type cannot be accepted according to current security settings.</p>
  </blockquote>
  
  <p>according to WCF tracing it fails while trying to validate the response signature, because i can see the response from the server.</p>
  
  <h2>here's my WCF service settings:</h2>
  
  <pre><code>&lt;system.serviceModel&gt;
    &lt;diagnostics&gt;
      &lt;messageLogging logEntireMessage="true" logKnownPii="true" logMalformedMessages="true"
        logMessagesAtServiceLevel="true" logMessagesAtTransportLevel="true" /&gt;
      &lt;endToEndTracing propagateActivity="true" activityTracing="true"
        messageFlowTracing="true" /&gt;
  
    &lt;/diagnostics&gt;
    &lt;behaviors&gt;
      &lt;endpointBehaviors&gt;
        &lt;behavior name="CHClientCertificateBehavior"&gt;
          &lt;clientCredentials supportInteractive="true"&gt;
            &lt;clientCertificate findValue="clientcert" storeLocation="LocalMachine"
              storeName="My" x509FindType="FindBySubjectName" /&gt;
            &lt;serviceCertificate&gt;
              &lt;defaultCertificate findValue="servercert" storeLocation="LocalMachine"
                storeName="My" x509FindType="FindBySubjectName" /&gt;
              &lt;authentication certificateValidationMode="None" /&gt;
            &lt;/serviceCertificate&gt;
          &lt;/clientCredentials&gt;
        &lt;/behavior&gt;
      &lt;/endpointBehaviors&gt;
    &lt;/behaviors&gt;
  
    &lt;bindings&gt;
      &lt;basicHttpBinding&gt;
        &lt;binding name="DPBasicHttpBindingWithSSL" closeTimeout="00:01:00"
          openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:02:00"
          allowCookies="false" bypassProxyOnLocal="false" hostNameComparisonMode="StrongWildcard"
          maxBufferPoolSize="2097152" maxBufferSize="524288" maxReceivedMessageSize="524288"
          textEncoding="utf-8" transferMode="Buffered" useDefaultWebProxy="true"
          messageEncoding="Text"&gt;
          &lt;readerQuotas maxDepth="32" maxStringContentLength="8192" maxArrayLength="16384"
            maxBytesPerRead="4096" maxNameTableCharCount="16384" /&gt;
          &lt;security mode="TransportWithMessageCredential"&gt;
            &lt;transport clientCredentialType="None" proxyCredentialType="None"
              realm="" /&gt;
            &lt;message clientCredentialType="Certificate" algorithmSuite="Default" /&gt;
          &lt;/security&gt;
        &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;customBinding&gt;
        &lt;binding name="DPCustomHttpBindingWithSSL"&gt;
          &lt;security authenticationMode="CertificateOverTransport" allowSerializedSigningTokenOnReply="true"                       messageSecurityVersion="WSSecurity10WSTrustFebruary2005WSSecureConversationFebruary2005WSSecurityPolicy11BasicSecurityProfile10" 
                    requireDerivedKeys="false" 
                    securityHeaderLayout="Lax" /&gt;
          &lt;textMessageEncoding messageVersion="Soap11" /&gt;
          &lt;httpsTransport maxBufferPoolSize="2097152" maxBufferSize="524288" maxReceivedMessageSize="524288" /&gt;
        &lt;/binding&gt;
  
      &lt;/customBinding&gt;
    &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint address="https://myserver/service.asmx"
              behaviorConfiguration="CHClientCertificateBehavior" binding="customBinding"
              bindingConfiguration="DPCustomHttpBindingWithSSL" contract="ServiceRef.smssoap"
              name="smsEndpoint"&gt;
              &lt;identity&gt;
                  &lt;certificateReference storeName="My" storeLocation="LocalMachine"
                      x509FindType="FindBySubjectName" findValue="myserver" /&gt;
              &lt;/identity&gt;
          &lt;/endpoint&gt;
  
      &lt;/client&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>as you can see, i tried both basicHttpBinding and customBinding (converted with the online tool <a href="http://webservices20.cloudapp.net/default.aspx" rel="nofollow">http://webservices20.cloudapp.net/default.aspx</a>), i tried to set different variations of settings combinations but still get this error.</p>
  
  <p><strong>any idea? canceling response certificate signing validation is also an option, but how do i set it??</strong></p>