.NET Framework Bookmark and Share   
 index > Claims based access platform (CBA), code-named Geneva > SOLVED: Web services federation with Geneva Server Beta 2
 

SOLVED: Web services federation with Geneva Server Beta 2

I’ve run into a snag when doing web services federation with Geneva Server. Basically I’m looking for guidelines on best practices for bindings and end points for doing web services federation with Geneva Server.

This is the scenario:

- A WCF service (Service1) in an Active Directory (AD1)

- A Geneva Server (GS1) in AD1

- A web services client (Client1) in AD1

- A Geneva Server (GS2) in an Active Directory (AD2)

- A web services client (Client2) in AD2

- GS1 trusts GS2 as an Identity Provider and GS2 trusts GS1 as a Service Provider.

Basically Client1 works by just requesting tokens from GS1 using windows auth �this works fine currently.

Client2 wants to do web services federation by exchanging a token (acquired with Windows auth) from GS2 with a token for Service 1 from GS1. Currently this doesn’t work and I need some guidance on what to do.

My logs on the client are telling me that the negotiation with GS1 fail when my client attempts to send an Issue action to GS1 and it never even seems to connect to GS2. The Geneva STS trace logs are empty on both GS1 and GS2.

My client config file is below, can you see anything wrong with it? I'm thinking something goes wrong when negotiating with GS2.

WS config:

<?xml version="1.0"?>

<configuration>

<configSections>

<section name="microsoft.identityModel"

type="Microsoft.IdentityModel.Configuration.MicrosoftIdentityModelSection, Microsoft.IdentityModel, Version=0.6.1.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />

</configSections>

<appSettings>

<!-- Insert thumbprint for token signing certificate here -->

<add key="TrustedIssuerThumbprint" value="5d 39 50 0d d4 6d 38 18 6a 8a 7e f8 68 0a 94 64 59 73 b6 09" />

</appSettings>

<microsoft.identityModel>

<service>

<issuerNameRegistry type="GenevaService.WebServiceIssuerNameRegistry" />

</service>

</microsoft.identityModel>

<system.serviceModel>

<diagnostics>

<messageLogging logMalformedMessages="true" logMessagesAtServiceLevel="false"

logMessagesAtTransportLevel="true" />

</diagnostics>

<behaviors>

<serviceBehaviors>

<behavior name="DefaultServiceBehavior">

<serviceCredentials>

<serviceCertificate storeLocation="LocalMachine"

storeName="My"

x509FindType="FindBySubjectName"

findValue="GenevaService.com" />

<issuedTokenAuthentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck">

<knownCertificates>

<add storeLocation="LocalMachine"

storeName="TrustedPeople"

x509FindType="FindByThumbprint"

findValue="5d 39 50 0d d4 6d 38 18 6a 8a 7e f8 68 0a 94 64 59 73 b6 09" />

</knownCertificates>

</issuedTokenAuthentication>

</serviceCredentials>

<serviceMetadata httpGetEnabled="true" />

<serviceDebug includeExceptionDetailInFaults="true"/>

</behavior>

</serviceBehaviors>

</behaviors>

<bindings>

<ws2007FederationHttpBinding>

<binding name="FederationBinding">

<security mode="Message">

<message>

<issuer address="http://jehdb2.genevadom.local/Trust/13/IssuedTokenSymmetricBasic256">

</issuer>

<issuerMetadata address="https://jehdb2.genevadom.local/Trust/Mex" >

<identity>

<dns value="http://jehdb2/Trust"/>

</identity>

</issuerMetadata>

</message>

</security>

</binding>

<binding name="DefaultBinding">

<security mode="Message">

<message>

<issuer address="http://jehdb2.genevadom.local/Trust/13/Windows">

</issuer>

<issuerMetadata address="https://jehdb2.genevadom.local/Trust/Mex" >

<identity>

<dns value="http://jehdb2/Trust"/>

</identity>

</issuerMetadata>

</message>

</security>

</binding>

</ws2007FederationHttpBinding>

</bindings>

<services>

<service name="GenevaService.Service"

behaviorConfiguration="DefaultServiceBehavior">

<endpoint address=""

binding="ws2007FederationHttpBinding"

bindingConfiguration="DefaultBinding"

contract="GenevaService.Common.IGenevaServiceContract">

<identity>

<dns value="GenevaService.com"/>

</identity>

</endpoint>

<endpoint address="federation"

binding="ws2007FederationHttpBinding"

bindingConfiguration="FederationBinding"

contract="GenevaService.Common.IGenevaServiceContract">

<identity>

<dns value="GenevaService.com"/>

</identity>

</endpoint>

<endpoint address="mex"

binding="mexHttpsBinding"

contract="IMetadataExchange" />

</service>

</services>

</system.serviceModel>

</configuration>


Client config:

<?xml version="1.0" encoding="utf-8"?>

<configuration>

<system.diagnostics>

<sources>

<source name="System.ServiceModel.MessageLogging" switchValue="Warning, ActivityTracing">

<listeners>

<add type="System.Diagnostics.DefaultTraceListener" name="Default">

<filter type="" />

</add>

<add name="ServiceModelMessageLoggingListener">

<filter type="" />

</add>

</listeners>

</source>

<source name="System.ServiceModel" switchValue="Verbose,ActivityTracing"

propagateActivity="true">

<listeners>

<add type="System.Diagnostics.DefaultTraceListener" name="Default">

<filter type="" />

</add>

<add name="ServiceModelTraceListener">

<filter type="" />

</add>

</listeners>

</source>

</sources>

<sharedListeners>

<add initializeData="c:\genevaserviceclient\app_messages.svclog"

type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"

name="ServiceModelMessageLoggingListener" traceOutputOptions="Timestamp">

<filter type="" />

</add>

<add initializeData="c:\genevaserviceclient\app_tracelog.svclog"

type="System.Diagnostics.XmlWriterTraceListener, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"

name="ServiceModelTraceListener" traceOutputOptions="Timestamp">

<filter type="" />

</add>

</sharedListeners>

</system.diagnostics>

<system.serviceModel>

<diagnostics>

<messageLogging logMalformedMessages="true" logMessagesAtTransportLevel="true" />

</diagnostics>

<bindings>

<ws2007HttpBinding>

<binding name="HomeSTS">

<security mode="Message">

<message establishSecurityContext="false" />

</security>

</binding>

</ws2007HttpBinding>

<ws2007FederationHttpBinding>

<binding name="HomeBinding" receiveTimeout="02:00:00" sendTimeout="02:00:00">

<security mode="Message">

<message>

<issuer

address="http://jehsst2008.t-seb.sst.dk/Trust/13/Windows"

binding="ws2007HttpBinding" bindingConfiguration="HomeSTS" />

<issuerMetadata

address="https://jehsst2008.t-seb.sst.dk/Trust/Mex" />

</message>

</security>

</binding>

<binding name="RemoteBinding" receiveTimeout="02:00:00" sendTimeout="02:00:00">

<security mode="Message">

<message >

<issuer

address="http://jehdb2.genevadom.local/Trust/13/IssuedTokenSymmetricBasic256"

binding="ws2007FederationHttpBinding" bindingConfiguration="HomeBinding">

<identity>

<certificateReference storeLocation ="CurrentUser"

storeName="TrustedPeople"

x509FindType="FindByThumbprint"

findValue="4e bb 35 cf 35 69 f7 62 a6 12 56 62 f5 37 53 d0 a7 ed c4 b2" />

</identity>

</issuer>

<issuerMetadata

address="https://jehdb2.genevadom.local/Trust/Mex" />

</message>

</security>

</binding>

</ws2007FederationHttpBinding>

</bindings>

<behaviors>

<endpointBehaviors>

<behavior name="ClientBehavior">

<clientCredentials>

<serviceCertificate>

<defaultCertificate storeLocation="CurrentUser" storeName ="TrustedPeople" x509FindType ="FindBySubjectName" findValue="GenevaService.com"/>

<authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>

</serviceCertificate>

</clientCredentials>

</behavior>

</endpointBehaviors>

</behaviors>

<client>

<endpoint address="http://jehdb2.genevadom.local/GenevaService/Service.svc/federation"

behaviorConfiguration="ClientBehavior" binding="ws2007FederationHttpBinding"

bindingConfiguration="RemoteBinding" contract="GenevaService.Common.IGenevaServiceContract"

name="DefaultBinding">

<identity>

<dns value="GenevaService.com" />

</identity>

</endpoint>

</client>

</system.serviceModel>

</configuration>

Error trace from client:

<E2ETraceEvent xmlns="http://schemas.microsoft.com/2004/06/E2ETraceEvent">

<System xmlns="http://schemas.microsoft.com/2004/06/windows/eventlog/system">

<EventID>131075</EventID>

<Type>3</Type>

<SubType Name="Error">0</SubType>

<Level>2</Level>

<TimeCreated SystemTime="2009-08-14T20:06:55.5630000Z" />

<Source Name="System.ServiceModel" />

<Correlation ActivityID="{c38caf88-38db-4d10-80a0-512d50cb5511}" />

<Execution ProcessName="GenevaServiceClient" ProcessID="3752" ThreadID="1" />

<Channel />

<Computer>JEHSST2008</Computer>

</System>

<ApplicationData>

<TraceData>

<DataItem>

<TraceRecord xmlns="http://schemas.microsoft.com/2004/10/E2ETraceEvent/TraceRecord" Severity="Error">

<TraceIdentifier>http://msdn.microsoft.com/da-DK/library/System.ServiceModel.Diagnostics.ThrowingException.aspx</TraceIdentifier>

<Description>Throwing an exception.</Description>

<AppDomain>GenevaServiceClient.exe</AppDomain>

<Exception>

<ExceptionType>System.ServiceModel.Security.SecurityNegotiationException, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>

<Message>Secure channel cannot be opened because security negotiation with the remote endpoint has failed. This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint. </Message>

<StackTrace>

Server stack trace:

at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)

at System.ServiceModel.Security.SspiNegotiationTokenProvider.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.TlsnegoTokenProvider.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.CommunicationObjectSecurityTokenProvider.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecurityUtils.OpenTokenProviderIfRequired(SecurityTokenProvider tokenProvider, TimeSpan timeout)

at System.ServiceModel.Security.SymmetricSecurityProtocol.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Channels.SecurityChannelFactory`1.ClientSecurityChannel`1.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation operation, EndpointAddress target, Uri via, SecurityToken currentToken, TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan timeout)

at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionClientSettings`1.ClientSecuritySessionChannel.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

Exception rethrown at [0]:

at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)

at System.ServiceModel.ICommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)

</StackTrace>

<ExceptionString>System.ServiceModel.Security.SecurityNegotiationException: Secure channel cannot be opened because security negotiation with the remote endpoint has failed. This may be due to absent or incorrectly specified EndpointIdentity in the EndpointAddress used to create the channel. Please verify the EndpointIdentity specified or implied by the EndpointAddress correctly identifies the remote endpoint. ---&gt; System.ServiceModel.FaultException: An error occurred when verifying security for the message.

at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)

at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)

--- End of inner exception stack trace ---

Server stack trace:

at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)

at System.ServiceModel.Security.SspiNegotiationTokenProvider.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.TlsnegoTokenProvider.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.CommunicationObjectSecurityTokenProvider.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecurityUtils.OpenTokenProviderIfRequired(SecurityTokenProvider tokenProvider, TimeSpan timeout)

at System.ServiceModel.Security.SymmetricSecurityProtocol.OnOpen(TimeSpan timeout)

at System.ServiceModel.Security.WrapperSecurityCommunicationObject.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Channels.SecurityChannelFactory`1.ClientSecurityChannel`1.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.DoOperation(SecuritySessionOperation operation, EndpointAddress target, Uri via, SecurityToken currentToken, TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionSecurityTokenProvider.GetTokenCore(TimeSpan timeout)

at System.IdentityModel.Selectors.SecurityTokenProvider.GetToken(TimeSpan timeout)

at System.ServiceModel.Security.SecuritySessionClientSettings`1.ClientSecuritySessionChannel.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Channels.ServiceChannel.OnOpen(TimeSpan timeout)

at System.ServiceModel.Channels.CommunicationObject.Open(TimeSpan timeout)

Exception rethrown at [0]:

at System.Runtime.Remoting.Proxies.RealProxy.HandleReturnMessage(IMessage reqMsg, IMessage retMsg)

at System.Runtime.Remoting.Proxies.RealProxy.PrivateInvoke(MessageData&amp; msgData, Int32 type)

at System.ServiceModel.ICommunicationObject.Open(TimeSpan timeout)

at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)</ExceptionString>

<DataItems>

<Data>

<Key>System.ServiceModel.Diagnostics.ExceptionUtility.ExceptionStackAsString</Key>

<Value>throw

at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)

at System.ServiceModel.Security.IssuanceTokenProviderBase`1.GetNextOutgoingMessage(Message incomingMessage, T negotiationState)

at System.ServiceModel.Security.IssuanceTokenProviderBase`1.DoNegotiation(TimeSpan timeout)

catch

</Value>

</Data>

</DataItems>

<InnerException>

<ExceptionType>System.ServiceModel.FaultException, System.ServiceModel, Version=3.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089</ExceptionType>

<Message>An error occurred when verifying security for the message.</Message>

<StackTrace>

at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)

at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)

</StackTrace>

<ExceptionString>System.ServiceModel.FaultException: An error occurred when verifying security for the message.

at System.ServiceModel.Security.SecurityUtils.ThrowIfNegotiationFault(Message message, EndpointAddress target)

at System.ServiceModel.Security.SspiNegotiationTokenProvider.GetNextOutgoingMessageBody(Message incomingMessage, SspiNegotiationTokenProviderState sspiState)</ExceptionString>

</InnerException>

</Exception>

</TraceRecord>

</DataItem>

</TraceData>

</ApplicationData>

</E2ETraceEvent>

S

Jesper Hvid
Hi again,

Amazingly I just solved the problem by sheer coincidence.

I went in on the client and manually specified the certificates the client should use for each party that it talks to. The problem was that the client was selecting the wrong certificate for talking to the IssuedToken end point on Geneva Server.

<behaviors>
<endpointBehaviors>
<behavior name="ClientBehavior">
<clientCredentials>
<serviceCertificate>
<scopedCertificates>
<add targetUri="http://jehdb2.genevadom.local/GenevaService/Service.svc"
storeLocation="CurrentUser"
storeName="TrustedPeople"
x509FindType="FindBySubjectName"
findValue="GenevaService.com" />
<add targetUri="http://jehdb2.genevadom.local/Trust/13/IssuedTokenSymmetricBasic256"
storeLocation="CurrentUser"
storeName="TrustedPeople"
x509FindType="FindBySubjectName"
findValue="jehdb2.genevadom.local"/>
</scopedCertificates>
<authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
  • Marked As Answer byJesper Hvid Saturday, August 15, 2009 6:57 PM
  •  
Jesper Hvid
Update: I'm now further in the scenario.

Hi,

I tried out the symmetric end point on GS1 just now(IssuedTokenSymmetricBasic256) and with that I get a bit further.. I at least see a secured message sent to GS1 from the client after retrieving a token from his local STS (GS2).

Unfortunately GS2 still drops a soap fault immediately after receiving the secured message. There is nothing in the Geneva Server, so I went in and enabled System.ServiceModel tracing in the Geneva Server configuration file. That gave me the message and exception below that GS2 generates when receiving the message from the client.

Google tells me this is a certificate mismatch, but I’m having trouble seeing where that is the case exactly..

<E2ETaceEvent xmlns="http://schemas.micosoft.com/2004/06/E2ETaceEvent">
<System xmlns="http://schemas.micosoft.com/2004/06/windows/eventlog/system">
<EventID>262162</EventID>
<Type>3</Type>
<SubType Name="Infomation">0</SubType>
<Level>8</Level>
<TimeCeated SystemTime="2009-08-15T09:27:06.9887500Z" />
<Souce Name="System.SeviceModel" />
<Coelation ActivityID="{00000000-0000-0000-1700-0080000000d3}" />
<Execution PocessName="Micosoft.IdentitySeve.SeviceHost" PocessID="5764" TheadID="10" />
<Channel />
<Compute>JEHDB2</Compute>
</System>
<ApplicationData>
<TaceData>
<DataItem>
<Taceecod xmlns="http://schemas.micosoft.com/2004/10/E2ETaceEvent/Taceecod" Seveity="Infomation">
<TaceIdentifie>http://msdn.micosoft.com/da-DK/libay/System.SeviceModel.Channels.Messageeceived.aspx</TaceIdentifie>
<Desciption>eceived a message ove a channel.</Desciption>
<AppDomain>Micosoft.IdentitySeve.SeviceHost.exe</AppDomain>
<Souce>System.SeviceModel.Channels.TanspoteplyChannelAccepto/56764949</Souce>
<ExtendedData xmlns="http://schemas.micosoft.com/2006/08/SeviceModel/MessageTansmitTaceecod">
<MessagePopeties>
<Encode>application/soap+xml; chaset=utf-8</Encode>
<AllowOutputBatching>False</AllowOutputBatching>
<Via>http://jehdb2.genevadom.local/Tust/13/IssuedTokenSymmeticBasic256</Via>
</MessagePopeties>
<MessageHeades>
<a:Action s:mustUndestand="1" u:Id="_5" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd" xmlns:s="http://www.w3.og/2003/05/soap-envelope" xmlns:a="http://www.w3.og/2005/08/addessing">http://docs.oasis-open.og/ws-sx/ws-tust/200512/ST/Issue</a:Action>
<a:MessageID u:Id="_6" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd" xmlns:a="http://www.w3.og/2005/08/addessing">un:uuid:4b0c5de6-5f4f-4746-a0f7-259e9bfdd66a</a:MessageID>
<ActivityId CoelationId="d7241d72-f1f5-450d-8a11-39f103137aa5" xmlns="http://schemas.micosoft.com/2004/09/SeviceModel/Diagnostics">0bf52460-abbd-48ea-bcf3-e8a858338492</ActivityId>
<a:eplyTo u:Id="_7" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd" xmlns:a="http://www.w3.og/2005/08/addessing">
<a:Addess>http://www.w3.og/2005/08/addessing/anonymous</a:Addess>
</a:eplyTo>
<a:To s:mustUndestand="1" u:Id="_8" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd" xmlns:s="http://www.w3.og/2003/05/soap-envelope" xmlns:a="http://www.w3.og/2005/08/addessing">http://jehdb2.genevadom.local/Tust/13/IssuedTokenSymmeticBasic256</a:To>
<o:Secuity s:mustUndestand="1" xmlns:o="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-secext-1.0.xsd" xmlns:s="http://www.w3.og/2003/05/soap-envelope">
<u:Timestamp u:Id="uuid-4a51a70c-9b74-434b-a869-1943c927184f-11" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd">
<u:Ceated>2009-08-15T09:27:11.695Z</u:Ceated>
<u:Expies>2009-08-15T09:32:11.695Z</u:Expies>
</u:Timestamp>
<e:EncyptedKey Id="uuid-4a51a70c-9b74-434b-a869-1943c927184f-10" xmlns:e="http://www.w3.og/2001/04/xmlenc#">
<e:EncyptionMethod Algoithm="http://www.w3.og/2001/04/xmlenc#sa-oaep-mgf1p">
<DigestMethod Algoithm="http://www.w3.og/2000/09/xmldsig#sha1" xmlns="http://www.w3.og/2000/09/xmldsig#"></DigestMethod>
</e:EncyptionMethod>
<KeyInfo xmlns="http://www.w3.og/2000/09/xmldsig#">
<o:SecuityTokenefeence>
<o:KeyIdentifie ValueType="http://docs.oasis-open.og/wss/oasis-wss-soap-message-secuity-1.1#ThumbpintSHA1" EncodingType="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-soap-message-secuity-1.0#Base64Binay">i/DIdVG9qkklTnWknMqL6BwWQ8=</o:KeyIdentifie>
</o:SecuityTokenefeence>
</KeyInfo>
<e:CipheData>
<e:CipheValue>g83IZZqOnGfuaigEsK4543Dg+I2hVtZyjkjiNDv+LUZc42IinoIP6V4qOf55bKmxl5xZ3CYaBCTdFiYkn2xiax/mZTlQSD6BAf03BaYtut9JOZ2uz1eGcqdG9JOdhTs9Lkc0uHe6aO+Q4pAt4TM5IToNy/Lt8iZvu5mA=</e:CipheValue>
</e:CipheData>
</e:EncyptedKey>
<sc:DeivedKeyToken u:Id="_0" xmlns:sc="http://docs.oasis-open.og/ws-sx/ws-secueconvesation/200512" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd">
<o:SecuityTokenefeence>
<o:efeence ValueType="http://docs.oasis-open.og/wss/oasis-wss-soap-message-secuity-1.1#EncyptedKey" UI="#uuid-4a51a70c-9b74-434b-a869-1943c927184f-10"></o:efeence>
</o:SecuityTokenefeence>
<sc:Offset>0</sc:Offset>
<sc:Length>24</sc:Length>
<sc:Nonce>
<!-- emoved-->
</sc:Nonce>
</sc:DeivedKeyToken>
<sc:DeivedKeyToken u:Id="_2" xmlns:sc="http://docs.oasis-open.og/ws-sx/ws-secueconvesation/200512" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd">
<o:SecuityTokenefeence>
<o:efeence ValueType="http://docs.oasis-open.og/wss/oasis-wss-soap-message-secuity-1.1#EncyptedKey" UI="#uuid-4a51a70c-9b74-434b-a869-1943c927184f-10"></o:efeence>
</o:SecuityTokenefeence>
<sc:Nonce>
<!-- emoved-->
</sc:Nonce>
</sc:DeivedKeyToken>
<e:efeenceList xmlns:e="http://www.w3.og/2001/04/xmlenc#">
<e:Dataefeence UI="#_4"></e:Dataefeence>
<e:Dataefeence UI="#_10"></e:Dataefeence>
<e:Dataefeence UI="#_11"></e:Dataefeence>
</e:efeenceList>
<xenc:EncyptedData Id="_74bd6b50-f64f-4405-a763-cfc481f435ac" Type="http://www.w3.og/2001/04/xmlenc#Element" xmlns:xenc="http://www.w3.og/2001/04/xmlenc#">
<xenc:EncyptionMethod Algoithm="http://www.w3.og/2001/04/xmlenc#aes256-cbc"></xenc:EncyptionMethod>
<KeyInfo xmlns="http://www.w3.og/2000/09/xmldsig#">
<e:EncyptedKey xmlns:e="http://www.w3.og/2001/04/xmlenc#">
<e:EncyptionMethod Algoithm="http://www.w3.og/2001/04/xmlenc#sa-oaep-mgf1p">
<DigestMethod Algoithm="http://www.w3.og/2000/09/xmldsig#sha1"></DigestMethod>
</e:EncyptionMethod>
<KeyInfo>
<o:SecuityTokenefeence>
<X509Data>
<X509IssueSeial>
<X509IssueName>CN=jehdb2.genevadom.local</X509IssueName>
<X509SeialNumbe>73474242367259726012512372381117432273</X509SeialNumbe>
</X509IssueSeial>
</X509Data>
</o:SecuityTokenefeence>
</KeyInfo>
<e:CipheData>
<e:CipheValue>cUXk9o19HHSL6xalQS2Fqf7xMoBCiLcqi5WqhcYKZzwnDfKOeyuHbsH60UjVlJu2vKHbNlkwSYexGbz8Az9M2hhghUf1CwTVDZOaEGFY8+T8WBVnWqO5jw0yeF4UoB51+WdNNTpV55D6e6CV/QHMQGKDH46+uqopgmBDNTs2Uuf+6klj8kAbquoohw1cZyynwawAvjm1fm/aUF05yZhOwLQ9oXc4AxE1hGDDt38jCD5mXfDCSlyw9BlumCiTigM/ZyELUnxOnhOW8HmeLg1V3txKx2cfiHdZS8kGt4Lej00E+OPPLG+Yx4pV7/7qmoy+ohy1LiO9JfZiafQ==</e:CipheValue>
</e:CipheData>
</e:EncyptedKey>
</KeyInfo>
<xenc:CipheData>
<xenc:CipheValue>xoCUqiTFwcNQGf/OCcQH0PkkyfLxuaEodHgVYqIE95uB/AWEKAWE20mbE+NwUnPPMpbPoNT+T0/E3L0OlBSMMOX6U9yP7CcYZjsojPqWAbNbpf2MHFLpVx3T6Twkqo0k4F06xowepsb02+EGmuXL35WnKy4csEFe6YykYUugM5de0ikF1NTj4CNGIsfJE1v9y2EXg1PDO90ED/d3kqQnZxDqkvxnGlzABwLvMUQTiga+gWdDFcS9vaqwUMBqoxpp3toQZAzfMN0A6jgVQBVwDlgkbEJ4huvWuTYMaWhu2EvNZ04w2/8onF3PEMs2ONYMmJ+oeoNtxpg+wfx88p4B97beOz1bfHZdcPuNu9svyKt4ZsOoPuo9q5G1kjguuulM/2CbIQnnBAIhman7bnasjXUA0llNJO3ySgP8/vz1neyg9nhzlz0eUuxBB+6L9pGMwnX+bLafz1s2D/M/S380tvjygxXXVon3wqpaCXH0wM/CSkInzO2pldKpWaDNWLK4m5GCKoVY/PZQcoLs1klPAoOPZQuYIxZj1GWPS7fP6kmE0vBtLG+YT/nx26fqFgKNiSfYDW1Pek/sNJMSwCPYVj4incWNzunYc4961iYtit0LNaESLExOSKe4JN8ceoOiNg6IOI9q5n3kkti0MA3xqJ1g+hNhYq+uT4+9N/Vg7oWE+YPu9SLaWuI2FkTDHTCdLN18n0eD4upYYq9guAsbt1EmonBsupeoG1d/h5EEjVP3IbSVA/1Z2xSTSfJ9WzNndhHW6ooPzN4oB7NmXxXwWgUPambzgLdnv26H/gpn7Ixbf6gsSescuN4z/OzOeQtCMev94PUYUWLpuinLPY8k5wqjxzQdPLV8DsWHY71/U3mcv+iSfg32VHmczQCTVqlnxjlukEQWZ0ClctSJ7gEdOQKIkTJ1Qi/X47gFhwk4g7GbutQ9IuESPujOCjuyWPGUnH/EVIVe3c7i0Hl0yqs0CJPvXf7nJx8Vyj7O7TiSj4L0nVV+pN5aejFOGmNKNF3+TSXfwK1IOaUaV6WjJGdkiVwu+KqPkJyUozNxso8E4cqICki3LjwsnwU49Tm9n0FWzc9M0tSj2T0OmitECC6zlFMpAmP6m5fjib2aj+b546U/JToY/5K0lM9/H0O1Y+C7IuoeSmdXcfd3ta05nZnK6DQuas/eMmY1amz0//OTLoYxWo4kGvA6t2jN0av9WqSvS3XqX6t706YT5+M49YqKpYbUF1aXz6K2zTAMSoY/UWfTOdK2nSSmOzYylf3WQ861ct50gMZFPl4p/bASIAVp2kUFjCzb/xXBu0NMu5i8JeC6AA9uaFD9OIOl94XeqYNJQSJU3Ith2G46yBY4caBtdHxX9tfKznxmM47ke31DlzvQWzlo9IghDBgV6SXQ25B0kdhceDTYyg/MNh22MFIh3GjtleNLsbhPGdsehvjXb2NqBcOYsUaidAShWMxVneHBnc7M/KzGI/3TImCYePcKbbcq3l6UNEY94kQzqBlYqJTpSQgq7a9Lgvg/4e9ueziAFosAYtfmTT+PhjTisNdgeTvT6uWFqOW11sMgmnk6k5VUExJj1h+0tDN9v0PMij9GezFt3Gtd7dE+46Q0JEdtwM6pcO7jiatu7wVy9O+otqb/TFvUtf4hVuLj06267lnhYpVVTFZ4DU9YaIALUcf4y9wC2wmUC8DodcKHF0EiYM7tTGqSCsPjyt2T6UZFbIQ7vAWCHVXeb+qcTm5+WB0mOVMjSqN6PTcEnlpKdSKW+9LzoeCZ5J7/ePK4XWHpoMmsPvQ7Ltc59Tjk6c+Dky7pqeFB3HZ4YpLKPlodMU5AmVM1PyJu908bvwTefj73ksvL1TNDBU6aQKevSwhFdbhW4N++pppucfYDdMGPTZ3YzMh+2HN1a1Ep1cQ4otFEjeLiKhJzvfmtBSZ8Kno/kKVJcM+U4p+/JUSoZ0JJv9dwOmLHHVYY1bE/JmfMGziV6sWlKLAPd9iSFi+Qwh/pQB7JpQfuXKaVidaTa8w/9pi6n+gQua6T9z7/WqbADUWM1YBElahde0xb+uEOA+yqedbahyqgHo9Uva+F9ZzY5i+YLxftlJfaIutWyiImmaGP5mFJchc4kGSnWGVPIwEPCU63MpfNHZf7kinAENF9NiVMEwbfQ1nAUy0+Q5XLdF5CQxmGMiY+DdKTtpc9QkXy48VBWcTjp8ivQfona9mSP3b+uwh4Lal+oSxc6oZBfiHMSAn8xp1D43hu3dp62JdIEXyCaWK5P1a+yITkUVO7lzUuTAhOK63dhJInqAS1fS2xvuQft72kQE7cDDLW98wI9czEZdxEKu51QAwA3vd16kJNONeyYDChPYcjoCg01qsAKzE5yM9YFLLvwnsmBjw/MkQF7gm9x5Ccmpd3LdxQw3Od5PH3pyeUhw3xMYnxpFhSTByNkoQ1E9SgKn2OOTETy7GT5HcuykJ+5SwmqteXKdLpXXVC1jqQQgTjkPHA9D710fUVJf+A2sPaJp2z2HggaD+6OfV+swKEiBv/F/iPIA5cXnMkVw5KS0qDTBIghpkxDeneSnZJQEdkAYkmXTDPkGL8TFCffjoQOeJfgE8KDHUKscPwejDCSOnYYlexuZ0mZLcK+/PQUHeyi32GsGolNCpTy8tukO6n/yMlBcl5K0sl8+/l+Dq0IYEa614Lhh62DFWcUKJxKMZ0SY1aVfJuXM2iD2pEabgzC9BJwEm2x8cDNV2U5CGozMFcxDFhIoEHOl6VDccI+nucyO37EaouoatLjwymY9Kplo5Mpsq+69Zb4zAi9htDJP9Kf/BY04393L66/Nxq8QzjQ7U9hZIhkT4BDhNj0fCA5oIf5wTdlWXqMeqHGl/iGamVoMg/LtbqLKF5Ntu9zlq/afcuz32aOpghZJ59y+GeUip2JccZdQhHU33nkTuDLt9i6CItmqtU0ysj3yqVf0z3qSHGkvO4XaX36uK67GWgp24DBG2iXtG8DL62cHQnx80j1jOpmHEUv7jxN9B/GpLYftLPIwDXz6Djj+1PtvDP6U4mg0vz5kSb+t4G9GPTAGmIw+4tCmskHSzMnf+yUQjxw5utupxz/luwfOe7cz/PDHOWTccG3pQp8JeVJ8AL3tfVQM6TT0eod+sBU5vYJJYJ/sNc1O9QnA5TsQTVbgUU8/MADv88IbGWQMmbUKysZsGJ1LEMKoyTHEPsHvbISJvWiYT+KZBgGQGGj/XAC6Mp+AQNM+iLS99iI+FHWuLLXFK4lBZ94z6xGEeeh/v3k5+8YXdy40x431AVumJG7uHIw96Y+02CQQe9N3wfKs2kH3bldxAjn5Kh/hOoKQ4iBz1qoIFdC2XLZ2t01SpuZNP1kjAecTULOuPiibPgiKdQlF56v+jODHLvSZI5gYGQ8O/Qvj0PoY+f2tnxPaGo33Ep8iLB1pa8Gja4t+gToOy85vof5M6FBa6H4gTiWSqLKGkwZ2x4t9OSUFUvDIQkB18YAEVL51hJZy3db9nB6L18hHqJKlJGwPaQpTb5dvxJ0kQyyy/imkKnikAUwhECKVzdJfni4coYHXxnPew2s/e5+on9MMEls5yt35XTgVlDi0FqdKYL+yJ8y486LNTVX2naEcc0taClu0t1Yc+Zk9equcE+OHtB8X/P9KaBOJoehNIIuDfyfALXWmmnBb1DzpYZ2hQBSmcsm0VaXQmkuklBSCU6cvd+tlL2l5NA8JYLfb1myF9e4xJLQD8tZlNqb+k2k1Ny+csXxJAd25KHw6pyHA7KOfMpKVBsa3ueFuIsFzFne6hjqqzCGmdf7Bw3Ty/9ogZh/x4bMC/uJv4g7E/22O5WWGfvFXYoAptfUHs5AAjkkGwJBJs9cI2x1OsLO/VlhAng5DjEqC5WcF3seT5PjbQj3keFSDUhZyxL1LI1Y6xLVZiXKU3b4cSBdfyMosIlvaHfM3kJcPmyQNvEL9j6/SON0wYPjPWgxEXJ9HeVG15tS81NpCqx/jpWpbqgI7uulHeXI+0fKS1jiAMCTtP23siH13+ZqGZnOGfL99K6Y2MTiOvZ0UCi84olzYNB3qUVKMI7BL7fn08fLGXUtdm4HHduSb7JZyxnicHBOSj2qOJ6yLe4gU6gkMWKfpOdoB56LqYe7505c76wcPvFMUT/Q6pmtT3V8mJ7wkkui1i8+kN88FFZEGHibHKml1YTTbz6kosyWsCJ80eWZc3Ws3l6cythEbdG9Ye7d4dTVnX+WtLWoe1/v5ijPagFev3xAJgqJwMgEYm07K30gBUkvcNWm4hQkHaTs6M0w31mkgMMX21Ayancx98kFTOtfifc4mlUOoGt9n097fGZWTtXgHLuIODk7yXILkLOfaef1kpxjh9nll2O0tknhEYj75qU3cfJ5yI/hzX1Zi7IKwjjZjvkFj/YHTYOH86AUA+WypyO1qP7xVIth9ixb/sG4lSAl5Im9Bs8+FHdehyczIbV8iGU+qLJsyp+gHgfC86K+oujvwgl/iY+T/9kQP031WMwn0fO904iuCuvlakwIspkTx1I5oAUmp8w+GhjpvnEnzF8unMyDPPIN3QYnZwOnh6+UDbzmLHfZjPEgF77+HBsCtT3+HUF0NOW2LthuLoD8A4yL2BsdnNAI/ynPlhs31ZX/0HD6Xf9ZHzC6UbAPnaMuz5/oXwSIE9dNih71MhZ1mhfz8x3iyhvh546Gj22uQppkU90B4MUT1D7h76gutIshFfL2ySwwC6XH+jWNdkW9+YVVjnzgVl3tQnZCUfZhnCL0KLaoPVvt7KpcTcpEApNzOGD5BAoUs2DPFGmdaKYIfVgFwDA3Oa79xH0pAtPSg/sxtKUYI8GD6khcx8IMzewO1kOQ/vowGbWtE/5YN75jJsN8siAl6vXxC3F+O4t4cIkdqtLG7ywMstvjwXXVG9EFA7AqJDyaB3/55OlY4+GjUWdL2bCKsYGgDVjqLDTZzLnECIhycLMc6xjTHDv5fnfkbMoS0yJ4WHEozmNud9Mh8Pz3lWbKUNa7q19ns9DopzTe3e1dEI6YabwND8ykQYtSSQ/eksEDhQuivsF/oAe2vP09lJbbD/6Q80bbJvzHI066BhWVKiC/kqO+MZsTiGOGnjktke9ET9unWMZZgk21gpUpwS3C7yPAmC2XJDsCjeh5YmGCPxxf0k7+HqshTzsZdlVGLLE4+Yd8jStQ4QOkOm7Lv+sCywcQWLjyqKSGkD9kIlmHw9cspvBnCyJKG/XvagMuLxYQIvjzJTT2LNs4qLs6fKAngCZ2/LbcoeVVK0EfexKAcGil9u9Ff2J4qjAb/eS68lOjZLz0689MIeXE1TdXSWpwVH0qjoQEV/7kOMb5Af1uK+23YT0tKu9tWhHqFQagqnElFqoig4+uvoxf/thCsfzxjbJAlfcNi/iJbSPAIfCuZo14BWXBEs/WhUm3ALQVhCdB+OM2AhkifZ7qnT4GKjcKUuhZ8J5uNE1XqZ/Z1OBgKqn8JAVjBYJAdmaq/A9q0djAFXl5x10WwBDygb0uDMOuPBfsiEWfWSNqmYylZEnsdChY/LQm33emX1gvGa7Odx68fCflAfgbO81qPZJfXi0hytCl5PysSCafs1UQCu1AL3looV+8J6bgHTf9JPxKkhxWaW8e+MGs3vOaUU1c12qmNNqsJpK/6Mf+9/cLTXTiZJv+D/K0OYWiVUQYoiSQuJlSqsAWieADFsBppmbmOSlkeN5qdYTT/qJSe700kZV94VmuIAJ6zvn9UVjoYZugMJY9IsAlkHEvzky2WzU8oZmv56cGqqAaLzlSlZehnfQVS4QK5uALVpYGHK+u3WvoYXhKex9Vkj+iQB1yVe3QiowK3aWlSiuwiHkYc8EbNcXodeDCHLfwGOV/X+MXbpy9h0ozaY69lOx4AlXoYWikNwNQH3Fdc8mu8+OOKIoNismnVC6eusDgauf8qVWCfIHaKsyO88m1Y37w/0jBcZ0OGH3xdE3JdlZFI4LIsM17/90VaKiTjjdhDY+DAmFUVYBu1OSYljKxZqKNPCOWog0aI+xw6VJBelEIpewJ2/t0HwJC3oXO4KjtnuJtbjFokphh9DHoL2hBiS0eJV/0q+f9WQdyyHh+gNLM9On+OzDNWgmkoWNMBotLLjxxuQ8Q8+bl5xEPS1SBouBI7ShKoBTagAh5SHq9VOI3cJdsVuZSIcTqS4iSxlBM74ZizBIexom1mVhIGKlj3IkkuL8GZq5N+qAvUMtJLBsM4QvjuaaHlL22mBxgQ7qW2QoU8/Kn7j3G7UvssZfkueKoO8vsOKJzx78waMvNUMGYeEGt4CtMwXsp1pxxm6FGkGCfZfNfZvP41E2Ym7gZKmJCakv+4HUh6S5ZMd+HVObjwJY/9P+h0nY64nAUGiBwT7i457htyi1g7FBwZJ3SG/KxYDYyiDVS9ulti6ek5zfUuWHA8sOO1IgvcHNyDxHNOb/pWCW3aL184kB5eOWOTkqDYH68TLgDVmvTQUFtwZX65XZP2zuJHIiyMQL7wW3BMyDV0/p0+D7q/lhjSM3F152vPNDysgfatCdOIwVdxJXv1gbX8FJaI19dNoPVKxOBkbpoyuS+aHeVZjGMKO5n81KQXvgG6sCUDej2A8kWt253v7JjXfabbNIqLcsWJOD1LXt7vuKNWFiWZYy6Ad+0slYlqSQ2sxnKs/f3eC5hQWOPJkuIyyOmQ4AuLNcdmQZcGCTSW8BdJ8KxgoJPKwYbzfj+0GQwdE8IDgCQjwL4z7QWkSUlpnHEvCyAFbN1v3svUNyd/8YMXV/Oj9CM68yOMHcCpxB4QHqO8Gfh6T0UZK7Gapi74JpDUhKdG+ivdFDmfs9OBw8qz2hgefBN5ha1wEB2nbwQaWGzXfNgA1n5+Qtq9ZQGEsTBbwJHg++sfefnoiNzIz+GaB4oZlji38q/oW0KyAeBtAQXW+dtQHVdKb3PJoZG/Jo2/hIlMsSD5liletBKLeVk1apaSHUB3IaOuz+TehzLvc9YuT55lCabEvhzCO1lxb62kt0XHgpf6UHFfxTMdUekmjshxUhKPKS9U9MFa2suKGHSzTcE7jQKf+v7BTwtPdhEeqW6QibL1J2dBsGeFvda/IPqzdDzWs3k6Yzn6xNHSjnI64KEINlb2eJQdcTkNoZAESVC47h2v8vVwg36zwbtyYOkJsgB7d5qYQ/Vswb2qFMxom0TTi5t6mwf6n2BvB04gJ5ybzMT+FYM/dhy2l/ZloDmT/XQv61nN4DSqBvqDm46bbB7IThdSc9K+JmkFjBXd/4uSbcnm0cVhqF2SdNBy6piCDkGc0uyb1oLgjC6NyhJ5E0nlT+hYz1my6VtcAOTG0ehiACBUwmChValWDc0I3LSA82oW+xQpPpiZydyx6VKO6oYql/QPIfmdIKeDBj0+3LEzELlW</xenc:CipheValue>
</xenc:CipheData>
</xenc:EncyptedData>
<sc:DeivedKeyToken u:Id="_9" xmlns:sc="http://docs.oasis-open.og/ws-sx/ws-secueconvesation/200512" xmlns:u="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-wssecuity-utility-1.0.xsd">
<o:SecuityTokenefeence>
<o:KeyIdentifie ValueType="http://docs.oasis-open.og/wss/oasis-wss-saml-token-pofile-1.0#SAMLAssetionID">_c12f0487-f14a-4d9d-981e-e2a429bd4375</o:KeyIdentifie>
</o:SecuityTokenefeence>
<sc:Offset>0</sc:Offset>
<sc:Length>24</sc:Length>
<sc:Nonce>
<!-- emoved-->
</sc:Nonce>
</sc:DeivedKeyToken>
<e:EncyptedData Id="_10" Type="http://www.w3.og/2001/04/xmlenc#Element" xmlns:e="http://www.w3.og/2001/04/xmlenc#">
<e:EncyptionMethod Algoithm="http://www.w3.og/2001/04/xmlenc#aes256-cbc"></e:EncyptionMethod>
<KeyInfo xmlns="http://www.w3.og/2000/09/xmldsig#">
<o:SecuityTokenefeence>
<o:efeence UI="#_2"></o:efeence>
</o:SecuityTokenefeence>
</KeyInfo>
<e:CipheData>
<e:CipheValue>j4hPFVVgmQG+cJYoNeG5kYnFC84zM3PpdgcNcNLiFoxeFJuxP85uPoKdfKfFyWHI9sep4SPoiHDws80gFFuW94WlY/WnbkEVh/HMAUXvmUNG5PT73DVwUzMA9tqsb2B+hph81QCWv82USaLq0GQQchTTlf3AgMdBZ9E2ynl+z515mV7zwjzhbnMGjSpxMJpOMonMH/7qaGioLPZEkHaUBeAi3zGzjFXK2qz9Fq+8MJJJ+YGm0PG4uZaLX6GjfqpJ1sDcCLllSsbdeIda1XOW4uHb0AYIC52EapOAPwOx+SkCuv47Mg7BAhLEOB2MO3piQ4j8EuFcovxPY9vGuKu0Kw6Tm/EM21XkwGxa5Amm2e59zc4k3I/xVZ4X0AJE/epTXgyN9dgFqmWdyb4ZKl11Z+yUgjzIw3GMtg0PyKEw/kGU9VSBT4wqeAFe1clSZYIKX7K7Xehv20j1tbC7jl974gxsBU7X0pQ2keFiqxkdM1pTwOcpxWPK6KFH9H1jkuULWDCePuP5UI3SInmpwZUpv8xcng3iFiSVzeLh88qgS/2s2d9EeUuhiAPPqohiuI7QUMB8k++otxVE80kqPnsv+6pwgEvSm7P1Kh8MsQ0DGGeIjikM+/d9ehkctezliTIdBXOGVMCocq284IZkO0Y5lo4zGBgWd4BMsHzvHQ9mqixplb3iEMiE/o55tKHAJAd7+ZTabNu7iGMcwNybcKOiiVbtwd0X8tKnDMOLPsIX7jcv5DD6sFgZKNicU/32qKknBn0DK4aHkTn1FjQ8y/GFeKXjx8XsMSm7aSH6UnWNcKwCu17B/IDsHovFy9g8OWSUh2Ye5ZaQiSLC8HMtNm3ovF0HyC8bUwgG5UDgFmmj1GjKzmBFu0mBKU414hJTJU5YKQw6s+ivGzOvC5eYiPYMgVKgwHmeF70kq46P+ipb1GgPw9FFCLfMZ+q8oCmM6jNV/W1V/8tahOsmScDFj8ZKxaTpvCtsGiNLcYhC9ucXw8jZd5issv9S52cJ4lAxK3C+k/q55cQlMQg3nswDQyhlczAGf1C50wZanaHfdVp4EqqWTegw5SqsChJz1PUa+5/zuKIJ8GwAl0vpv7Qkk7lpaHLhm53Z+CWj/lkXP5QK028a1iXp3SXE9AsjW3IBNdy7n58658YCTdEs8ML/xkd7QonSHtXW9aGC7zFmUQ6XYMV0e1E02iSWz8BwVBIOAX+6gUL6+6H9XAPh6MKvQXBOeUGJgNEwGTAyfynKLWjuYNz7cZQ0W7JHnnIuW91xAcefAGoAAws5nh10BGUJKnUDxXx69PYinX5FgbFMg+yXD6zs8/ccEZLFUHPx1UL1aY8XjKV5QjVaxL1vv5kwjApalZ8e33D56etHlHVSTOZjbHpJaIO76TnSNDajFne90XVGTInhA+V5tzxf+bjI3ysdJ5WBT4eKic1sBjQQYMk7y9GnBXGk3AVeWEAFU/KdQfE+D+WgW9nIo/I9ZPd8Fd1z6Mn8744vFJ6hhLU0V22jyyj3pLj3ysFNOgH2NdOiIyd1VbvhIBiGxI0Tw1uLM4uZazT+0Y8MKo81XZJ8B5/um9W5Z20ljYiXmSBkoCMMgLknKWSXLGjNgpVzGJ8VJIy5mjfoZdbBHdfUl0bMsXhlCqlchsHAvYlLjabqN47u1ldHfaBBxhJPxq71WloUPcZVqmF/98bXtwAc3FZQNdye5BKON8aVcDLFOkhPVEuJBOHm3c92Uo1XSAP2zbxvCbwCq9b/fSXknzxGTJsV1PxyNKh4aKFFK4ODMTzP+ELo3P8HqtSJVl4sKzpVI4FClqbwd/FGFh6wFa9ECitsynfCgiZ3AkzuD0waiq4+2ByB7XWudQzeMgzmhg+xjIAiSTF2NJL/SgWCiVnGcLjVLLEFwqSgWhbLib5dPeHoOqEWj0wUKP236SdIUAsefU8ntKhOnvisJd4juj92svT0A5db2zjXGSoelB+mwgT7yi9vHEHfML/pd9wy2IT94LS5pAiu/K5DAQ5kEZoFIM1GLKandZMK6p6sSyxBEZCnF6Z7CMGzYW8oLmIXDCdgTaDk2+uC6Os4EE5xDHKTJemqqtlozL8c7AmiB+bwj3Aw4njkwy/9bg6w1HXnqF8xnMdCpBnxfA1hBHQf2ouchjJDbpHnGK/lskYbLu5CCEJSoczWfv8+UAjDwjv2DZfigFJ87i8ZoBesxBuq3pi9kolkZbtsMtXwgd4sTXAC+JoFnVC41/vCLDd6xSKAmDpA3Ban93onLYk5KcgD1X0zQsGdADu0L/5L6YJiB4oxKsP98z98bmWJTYSpiAZHg4F19jovNK+XkZuqJOve/vk6Pa2QWhneFiyv5XN2VKHG7yl6dSdyN5ayg2q5Jqksbj/8H0x4eVgSF6/MDuXSyJEAU1Ab/szTVSGaLfTCQsA9uFD2ZwhqhudJvECBHIy3ZuEJhpMHo6CJTSk787SYpVqkVXIjutMD8/I4B9qDWkWpUDxyictEHuYMvXh0IlPC1osDmjlY8JwqXJH206CYVjSXhvQoTdnYx7PGMuTlF0nI+5Y6LHYCudYjsgCM6fdHi3qL1YK1F/o1eGjZ1</e:CipheValue>
</e:CipheData>
</e:EncyptedData>
<e:EncyptedData Id="_11" Type="http://www.w3.og/2001/04/xmlenc#Element" xmlns:e="http://www.w3.og/2001/04/xmlenc#">
<e:EncyptionMethod Algoithm="http://www.w3.og/2001/04/xmlenc#aes256-cbc"></e:EncyptionMethod>
<KeyInfo xmlns="http://www.w3.og/2000/09/xmldsig#">
<o:SecuityTokenefeence>
<o:efeence UI="#_2"></o:efeence>
</o:SecuityTokenefeence>
</KeyInfo>
<e:CipheData>
<e:CipheValue>HJpn1oam0xO36Ax6Uh7NZ3y7Fjp33vYtG3o+yypfdc0obEBUIkzSFg85opNqnk7axsYdSdhksxxiW3lZElXwmQTZ4+8z73PNxA6gy/+XZTdbcUtJYZl2Knm/Pk6AeQwhwwO3VZlk3jUbghcjmjJaxo03S9czEVCUoqpky707bOl5BaDN4y1Fgc4Mo+jG+UEFoMKkW60/n8EPKyPj8MvZN8XJjKH0E7eggUIBlYkZH6q7kY+yh5IWTESflmeX1ddmZsWOb5GfXqmzjbSg0wbHQ1E5/e93fUwziVf3KYBzYMj0pYmMfBSK0tdcB3BNCAGfYFdbOY0MWzJee1KqQ/26zpA4y/ssvwzNf8cQPt2hOyNNX/A4GFPWwJPzbNwhC7u+jXhziSbkb1vkSjL81fzcUpo/8UJPoOndTYBAcBFm/qIFeNU1mv5hx1uTCX9qpEyOGdGDoQqNmhvOFclXLuFgtMtXt/WqLo7JmVhWsLqy+DZ7ziO0DdZSiJtEWxI5uFjt8j0iDaJ/4mfcUqq5mWOA+x3TUIk+U4IxHFG9dLDnneyXQdJ24OH6b95+uazk7kQ1d8awlaJlBCCsmWBesdmv3jS/SZqbtZS1GuHhzGzL0nOEtIaag+iwF/EaAL7SlHNNc04qc84UfSBL0FFTQFokJs2ukXnPQT2l9VXQXCDdXYF9Qj+eB1pfiCeDCSh8SOnkHg7ducdo+OHWIq4YdQbSKPtHB8YwfTKeV7AvVFZyNVXa/FLfTeL7UYaoDUbImE04u5HMBVW703IpGdxgWVVpU5qYGtc5+Ta1nqQSt/yoSIJN9Hh46TWBkdHjqyENd99BuEYJKnjsTHPP4vwCfBqhF4hEsEIN4ICo6VVZAMJAUX+mIzX42bshLFJ2Aaxtcl4o6gfl3cxBLhU4XX6loBlaYIVq6T2Ey2MvFaib4DyA/7GKLcwLkDZpIOeiKTSL97d0BAgISP2G99ad6c=</e:CipheValue>
</e:CipheData>
</e:EncyptedData>
</o:Secuity>
</MessageHeades>
</ExtendedData>
</Taceecod>
</DataItem>
</TaceData>
</ApplicationData>
</E2ETaceEvent>


<E2ETaceEvent xmlns="http://schemas.micosoft.com/2004/06/E2ETaceEvent">
<System xmlns="http://schemas.micosoft.com/2004/06/windows/eventlog/system">
<EventID>131075</EventID>
<Type>3</Type>
<SubType Name="Eo">0</SubType>
<Level>2</Level>
<TimeCeated SystemTime="2009-08-15T09:27:07.0043750Z" />
<Souce Name="System.SeviceModel" />
<Coelation ActivityID="{00000000-0000-0000-1700-0080000000d3}" />
<Execution PocessName="Micosoft.IdentitySeve.SeviceHost" PocessID="5764" TheadID="10" />
<Channel />
<Compute>JEHDB2</Compute>
</System>
<ApplicationData>
<TaceData>
<DataItem>
<Taceecod xmlns="http://schemas.micosoft.com/2004/10/E2ETaceEvent/Taceecod" Seveity="Eo">
<TaceIdentifie>http://msdn.micosoft.com/da-DK/libay/System.SeviceModel.Diagnostics.ThowingException.aspx</TaceIdentifie>
<Desciption>Thowing an exception.</Desciption>
<AppDomain>Micosoft.IdentitySeve.SeviceHost.exe</AppDomain>
<Exception>
<ExceptionType>System.SeviceModel.Secuity.MessageSecuityException, System.SeviceModel, Vesion=3.0.0.0, Cultue=neutal, PublicKeyToken=b77a5c561934e089</ExceptionType>
<Message>The EncyptedKey clause was not wapped with the equied encyption token 'System.IdentityModel.Tokens.X509SecuityToken'.</Message>
<StackTace> at System.SeviceModel.Secuity.WSSecuityJan2004.WappedKeyTokenEnty.CeateWappedKeyToken(Sting id, Sting encyptionMethod, Sting caiedKeyName, SecuityKeyIdentifie unwappingTokenIdentifie, Byte[] wappedKey, SecuityTokenesolve tokenesolve) at System.SeviceModel.Secuity.WSSecuityJan2004.WappedKeyTokenEnty.eadTokenCoe(XmlDictionayeade eade, SecuityTokenesolve tokenesolve) at System.SeviceModel.Secuity.WSSecuityTokenSeialize.eadTokenCoe(Xmleade eade, SecuityTokenesolve tokenesolve) at Micosoft.IdentityModel.Tokens.SecuityTokenSeializeAdapte.eadTokenCoe(Xmleade eade, SecuityTokenesolve tokenesolve) at System.IdentityModel.Selectos.SecuityTokenSeialize.eadToken(Xmleade eade, SecuityTokenesolve tokenesolve) at System.SeviceModel.Secuity.WSSecuityOneDotZeoeceiveSecuityHeade.DecyptWappedKey(XmlDictionayeade eade) at System.SeviceModel.Secuity.eceiveSecuityHeade.eadEncyptedKey(XmlDictionayeade eade, Boolean pocessefeenceListIfPesent) at System.SeviceModel.Secuity.eceiveSecuityHeade.ExecuteFullPass(XmlDictionayeade eade) at System.SeviceModel.Secuity.StictModeSecuityHeadeElementInfeenceEngine.ExecutePocessingPasses(eceiveSecuityHeade secuityHeade, XmlDictionayeade eade) at System.SeviceModel.Secuity.eceiveSecuityHeade.Pocess(TimeSpan timeout) at System.SeviceModel.Secuity.MessageSecuityPotocol.PocessSecuityHeade(eceiveSecuityHeade secuityHeade, Message&amp; message, SecuityToken equiedSigningToken, TimeSpan timeout, SecuityPotocolCoelationState[] coelationStates) at System.SeviceModel.Secuity.SymmeticSecuityPotocol.VeifyIncomingMessageCoe(Message&amp; message, Sting acto, TimeSpan timeout, SecuityPotocolCoelationState[] coelationStates) at System.SeviceModel.Secuity.MessageSecuityPotocol.VeifyIncomingMessage(Message&amp; message, TimeSpan timeout, SecuityPotocolCoelationState[] coelationStates) at System.SeviceModel.Channels.SecuityChannelListene`1.SeveSecuityChannel`1.VeifyIncomingMessage(Message&amp; message, TimeSpan timeout, SecuityPotocolCoelationState[] coelationState) at System.SeviceModel.Channels.SecuityChannelListene`1.SecuityeplyChannel.Pocesseceivedequest(equestContext equestContext, TimeSpan timeout) at System.SeviceModel.Channels.SecuityChannelListene`1.eceiveequestAndVeifySecuityAsyncesult.PocessInneItem(equestContext inneItem, TimeSpan timeout) at System.SeviceModel.Channels.SecuityChannelListene`1.eceiveItemAndVeifySecuityAsyncesult`2.OnInneeceiveDone() at System.SeviceModel.Channels.SecuityChannelListene`1.eceiveItemAndVeifySecuityAsyncesult`2.InneTyeceiveCompletedCallback(IAsyncesult esult) at System.SeviceModel.Diagnostics.Utility.AsyncThunk.UnhandledExceptionFame(IAsyncesult esult) at System.SeviceModel.Asyncesult.Complete(Boolean completedSynchonously) at System.SeviceModel.Channels.InputQueue`1.AsyncQueueeade.Set(Item item) at System.SeviceModel.Channels.InputQueue`1.EnqueueAndDispatch(Item item, Boolean canDispatchOnThisThead) at System.SeviceModel.Channels.InputQueue`1.EnqueueAndDispatch(T item, ItemDequeuedCallback dequeuedCallback, Boolean canDispatchOnThisThead) at System.SeviceModel.Channels.InputQueueChannel`1.EnqueueAndDispatch(TDisposable item, ItemDequeuedCallback dequeuedCallback, Boolean canDispatchOnThisThead) at System.SeviceModel.Channels.SingletonChannelAccepto`3.Enqueue(QueueItemType item, ItemDequeuedCallback dequeuedCallback, Boolean canDispatchOnThisThead) at System.SeviceModel.Channels.HttpChannelListene.HttpContexteceived(HttpequestContext context, ItemDequeuedCallback callback) at System.SeviceModel.Channels.ShaedHttpTanspotManage.OnGetContextCoe(IAsyncesult esult) at System.SeviceModel.Channels.ShaedHttpTanspotManage.OnGetContext(IAsyncesult esult) at System.SeviceModel.Diagnostics.Utility.AsyncThunk.UnhandledExceptionFame(IAsyncesult esult) at System.Net.LazyAsyncesult.Complete(IntPt useToken) at System.Net.LazyAsyncesult.PotectedInvokeCallback(Object esult, IntPt useToken) at System.Net.ListeneAsyncesult.WaitCallback(UInt32 eoCode, UInt32 numBytes, NativeOvelapped* nativeOvelapped) at System.Theading._IOCompletionCallback.PefomIOCompletionCallback(UInt32 eoCode, UInt32 numBytes, NativeOvelapped* pOVELAP) </StackTace>
<ExceptionSting>System.SeviceModel.Secuity.MessageSecuityException: The EncyptedKey clause was not wapped with the equied encyption token 'System.IdentityModel.Tokens.X509SecuityToken'.</ExceptionSting>
</Exception>
</Taceecod>
</DataItem>
</TaceData>
</ApplicationData>
</E2ETaceEvent>

Jesper Hvid
I suspect that this element is to blame, but I've no idea how to change this:

<e:EncyptedKey Id="uuid-4a51a70c-9b74-434b-a869-1943c927184f-10" xmlns:e="http://www.w3.og/2001/04/xmlenc#">
<e:EncyptionMethod Algoithm="http://www.w3.og/2001/04/xmlenc#sa-oaep-mgf1p">
<DigestMethod Algoithm="http://www.w3.og/2000/09/xmldsig#sha1" xmlns="http://www.w3.og/2000/09/xmldsig#"></DigestMethod>
</e:EncyptionMethod>
<KeyInfo xmlns="http://www.w3.og/2000/09/xmldsig#">
<o:SecuityTokenefeence>
<o:KeyIdentifie ValueType="http://docs.oasis-open.og/wss/oasis-wss-soap-message-secuity-1.1#ThumbpintSHA1" EncodingType="http://docs.oasis-open.og/wss/2004/01/oasis-200401-wss-soap-message-secuity-1.0#Base64Binay">i/DIdVG9qkklTnWknMqL6BwWQ8=</o:KeyIdentifie>
</o:SecuityTokenefeence>
</KeyInfo>
<e:CipheData>
<e:CipheValue>g83IZZqOnGfuaigEsK4543Dg+I2hVtZyjkjiNDv+LUZc42IinoIP6V4qOf55bKmxl5xZ3CYaBCTdFiYkn2xiax/mZTlQSD6BAf03BaYtut9JOZ2uz1eGcqdG9JOdhTs9Lkc0uHe6aO+Q4pAt4TM5IToNy/Lt8iZvu5mA=</e:CipheValue>
</e:CipheData>
</e:EncyptedKey>
Jesper Hvid
Hi again,

Amazingly I just solved the problem by sheer coincidence.

I went in on the client and manually specified the certificates the client should use for each party that it talks to. The problem was that the client was selecting the wrong certificate for talking to the IssuedToken end point on Geneva Server.

<behaviors>
<endpointBehaviors>
<behavior name="ClientBehavior">
<clientCredentials>
<serviceCertificate>
<scopedCertificates>
<add targetUri="http://jehdb2.genevadom.local/GenevaService/Service.svc"
storeLocation="CurrentUser"
storeName="TrustedPeople"
x509FindType="FindBySubjectName"
findValue="GenevaService.com" />
<add targetUri="http://jehdb2.genevadom.local/Trust/13/IssuedTokenSymmetricBasic256"
storeLocation="CurrentUser"
storeName="TrustedPeople"
x509FindType="FindBySubjectName"
findValue="jehdb2.genevadom.local"/>
</scopedCertificates>
<authentication certificateValidationMode="PeerOrChainTrust" revocationMode="NoCheck"/>
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
  • Marked As Answer byJesper Hvid Saturday, August 15, 2009 6:57 PM
  •  
Jesper Hvid

You can use google to search for other answers

Custom Search

More Threads

• Geneva Server certificate based authentication claims
• Managed Cards and the Access Control Service
• Retrieving all the groups that an AD user to which a member belongs
• Error - does not implement inherited abstract member 'Microsoft.IdentityModel.Tokens.SecurityTokenHandler.Clone()
• Custom Authentication using Geneva Server
• Define NameFormat in NameID Element in Beta2
• Identities are transposed in relying party
• How to authenticate a non-Active Directory user in "Geneva" Server
• Geneva Roadmap and pricing
• ASP.NET MVC SecurityToken Post Back error
Home          Copyright 2009-2010 by netframeworkdev.com All rights reserved