title: Delivering a JWT SecurityToken to a WCF client
body: <p>I need to generate and issue a token to clients based on username/password authentication.  I've tried several approaches to solving this problem, but all of them have run into issues.</p>
  
  <p>My first plan was to implement WS-Trust Issue on my WCF endpoint.  The example I found which did this used:</p>
  
  <pre><code>[OperationContract(Action = "http://schemas.xmlsoap.org/ws/2005/02/trust/RST/Issue",
                     ReplyAction = "http://schemas.xmlsoap.org/ws/2005/02/trust/RSTR/Issue")]
  Message IssueToken(Message rstMessage);
  </code></pre>
  
  <p>However, the changes to WIF in 4.5 to integrate it into the .NET Framework proper have broken the rest of the sample code to convert Message into RequestSecurityToken.  WSTrustRequestSerializer seems to do this, but it requires WSTrustSerializationContext, and there's little information on how to create or configure this context object.</p>
  
  <p>I tried simply serializing out the JWT I want to use for my SecurityToken type into a string and returning it to the client, but it looks like deserializing it into a SecurityToken which WCF can use would require me to ship the JWTSecurityToken and Handler on the client, something I want to avoid.  While the WS-Trust bindings seem to sidestep this somehow and produce a GenericXmlSecurityToken, I can't seem to find how to create one of these myself.</p>
  
  <p>Any thoughts on either how to serialize/deserialize the RequestSecurityToken and RequestSecurityTokenResponse objects within WS-Trust, or how to serialize/deserialize the token outside of the WS-Trust framework?  Or other ideas?</p>