This is a duplicate question thatI posted in the old forum (http://forums.microsoft.com/msdn/ShowPost.aspx?PostID=3508291&SiteID=1)

Iam in the process of developing an offline application and webservice for our client. Our client has a single sign on web application (not webservice). Using web requests from our application I am able to authenticate and strip out the SAML Response and import the nested SAML Assertion into the .Net SAML Assertion object. This is as far as I have got.

I have read the Microsoft article on creating a SAML Token Provider under their Security Extensibility Samples(http://msdn.microsoft.com/en-us/library/aa355062.aspx) which states:

"This sample shows how to build a custom token provider that allows a SAML token obtained from outside of the WCF client framework to be used."

I have downloaded the sample which works fine but as soon as I replace their SAML Assertion (I am signing the SAML Assertion with the same certificates the sample code)with mine it breaks. The following shows the SAML Assertions from mine and their code taken from the WCF trace log as well as the exception on the server.

My SAML Assertion

SAML Assertiongenerated bysample code

Server exception

The exception on the server seems to be self explanatory but I don't fully understand it so if someone could either tell me what I am doing wrong or point me at some text which will explain how to change the config (and what the change actually does) I would be most grateful.

Bro Num

I have tried to find some information on the suggested change to the 'issuedTokenAuthentication' under 'serviceBehaviors' in the configuration file but information is very limited. I have changed the configuration to read:


I now get the following error:

Again any help would be appreciated.

Bro Num

Right another step closer. After looking further into the sample code the generated SAML token has a "proof token" assigned to it (this can be seen in the SamlUtilities class on line 119). Once I assigned the proof token the comms work. My issue is that the SAML token from the client's web app does not provide thisKeyInfo in the Subject Confirmation element.Can Ichange the configuration to not require the KeyInfo and if so how would this be done?

Bro Num

Hi Brnumski, were you able to solve the "DerivedKeyTokencannotderivekeyfromthesecret."? I am getting the same error.

Thanks!

Hi Eazel,

My issue was that the Saml token I was receiving was not correct as far as the .net libraries were concerned. I was trying to read in a Saml response which was signed but the embedded Saml assertion was not signed.