title: WS-Federation sign-in Asp.NET 5 MVC 6 ADFS
body: <p>Hello so I've been trying to achieve <strong>WS-Fed SSO</strong> on my MVC6 web application, I've read a bit on authentification and all to identify my requirements. I have to use WsFederationAuth so no oauth nor saml protocol would work for me.</p>
  <p><strong>Edit :</strong> After @Pinpoint suggestion I tried to use owin middleware to achieve the connection, but I will use the full framework DNX451 rather than DNXCore but it's something while waiting for ws-fed to be supported by Vnext.</p>
  <h1><a href="https://stackoverflow.com/users/542757/pinpoint">Pinpoint</a> <a href="https://github.com/aspnet-contrib/AspNet.Security.OpenIdConnect.Server/blob/vNext/samples/Mvc/Mvc.Server/Extensions/AppBuilderExtensions.cs" rel="noreferrer">adapter extension</a>:</h1>
  <pre><code> public static class AppBuilderExtensions
      {
  #if !DNXCORE50
          public static IApplicationBuilder UseOwinAppBuilder(this IApplicationBuilder app,
              Action&lt;IAppBuilder&gt; configuration)
          {
              if (app == null)
              {
                  throw new ArgumentNullException(nameof(app));
              }
  
              if (configuration == null)
              {
                  throw new ArgumentNullException(nameof(configuration));
              }
  
  
              return app.UseOwin(setup =&gt; setup(next =&gt;
              {
                  var builder = new AppBuilder();
                  var lifetime = (IApplicationLifetime) app.ApplicationServices.GetService(typeof (IApplicationLifetime));
  
                  var properties = new AppProperties(builder.Properties);
                  properties.AppName = app.ApplicationServices.GetApplicationUniqueIdentifier();
                  properties.OnAppDisposing = lifetime.ApplicationStopping;
                  properties.DefaultApp = next;
  
                  configuration(builder);
  
                  return builder.Build&lt;Func&lt;IDictionary&lt;string, object&gt;, Task&gt;&gt;();
              }));
          }
  #endif
      }
  </code></pre>
  <h1>And in startup.cs :</h1>
  <pre><code>    #if !DNXCORE50
              app.UseOwinAppBuilder(owin =&gt;
              {
                  owin.UseWsFederationAuthentication(new WsFederationAuthenticationOptions
                  {
                      MetadataAddress =
                          &quot;https://mysite.accesscontrol.windows.net/FederationMetadata/2007-06/FederationMetadata.xml&quot;,
                      Wtrealm = &quot;http://localhost:62569/&quot;,
                      SignInAsAuthenticationType = WsFederationAuthenticationDefaults.AuthenticationType,
                      AuthenticationType = &quot;adfs&quot;,
                      SecurityTokenHandlers = new SecurityTokenHandlerCollection
                      {
                          new EncryptedSecurityTokenHandler
                          {
                              Configuration = new SecurityTokenHandlerConfiguration
                              {
                                  IssuerTokenResolver = new X509CertificateStoreTokenResolver(StoreName.My,
                                      StoreLocation.LocalMachine)
                              }
                          },
                          new Saml2SecurityTokenHandler
                          {
                              CertificateValidator = X509CertificateValidator.None,
                              
                          }
                      }
                  });
              });
  #endif
  </code></pre>
  <p>I can feel I'm getting closer to a solution but it's not yet done. I have trouble in handling the token (after the authentication against the adfs)</p>
  <p>I get this error with afaiu the token:</p>
  <blockquote>
  <p>SecurityTokenValidationException: IDX10201: None of the the SecurityTokenHandlers could read the 'securityToken':</p>
  </blockquote>
  <pre><code>&lt;Assertion ID=&quot;_851fc402-2e9c-4ff8-a743-7d65612255b9&quot; IssueInstant=&quot;2015-06-22T16:16:03.852Z&quot; Version=&quot;2.0&quot; xmlns=&quot;urn:oasis:names:tc:SAML:2.0:assertion&quot;&gt;
      &lt;Issuer&gt;https://mysite.accesscontrol.windows.net/&lt;/Issuer&gt;
      &lt;ds:Signature xmlns:ds=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;
          &lt;ds:SignedInfo&gt;
              &lt;ds:CanonicalizationMethod Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot; /&gt;
              &lt;ds:SignatureMethod Algorithm=&quot;http://www.w3.org/2001/04/xmldsig-more#rsa-sha256&quot; /&gt;
              &lt;ds:Reference URI=&quot;#_851fc402-2e9c-4ff8-a743-7d65612255b9&quot;&gt;
                  &lt;ds:Transforms&gt;
                      &lt;ds:Transform Algorithm=&quot;http://www.w3.org/2000/09/xmldsig#enveloped-signature&quot; /&gt;
                      &lt;ds:Transform Algorithm=&quot;http://www.w3.org/2001/10/xml-exc-c14n#&quot; /&gt;
                  &lt;/ds:Transforms&gt;
                  &lt;ds:DigestMethod Algorithm=&quot;http://www.w3.org/2001/04/xmlenc#sha256&quot; /&gt;
                  &lt;ds:DigestValue&gt;xZdzOnNIG5Ia***********t0feMWIZMLnY=&lt;/ds:DigestValue&gt;
              &lt;/ds:Reference&gt;
          &lt;/ds:SignedInfo&gt;
          &lt;ds:SignatureValue&gt;KmuScnZBdxyaAJrfLgB9AYheUdR*****************************Xs4o8R+eMCPdWNsDjhLu500UlCgitYerjpLTTyRRdwvFo8T7LlsXO2yjv3dx83Yn+GthE+FswNRH07yIHF5wo5+/TAwiVzg+9SDbK+Nj84PdLMxwIfALAebf4/ECdpqkWvt2ligzFoQckEgZMRepOcAVfBxfELyJSUDAjnpfJCrlCQip0nykC+5R37X00flIlB563p48veeLIt0JaUdG4bwtQ8OCMg1KeD5gYix9p4E3TQ7QovN0HDoWTurLK/0H01IS73fIe6/k6DBA==&lt;/ds:SignatureValue&gt;
          &lt;KeyInfo xmlns=&quot;http://www.w3.org/2000/09/xmldsig#&quot;&gt;
              &lt;X509Data&gt;
                  &lt;X509Certificate&gt;MIIDSjCCAjagAwIBAgIQrcBhMtovuJ**********************MDExLzAtBgNVBAMTJm1hcmdvY29uc2VpbC5hY2Nlc3Njb250cm9sLndpbmRvd3MubmV0MB4XDTE1MDYxNjA4MTYzOFoXDTIwMDUzMTIyMDAwMFowMTEvMC0GA1UEAxMmbWFyZ29jb25zZWlsLmFjY2Vzc2NvbnRyb2wud2luZG93cy5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCpeZseXX1IYTABUOPr7nfIAXc7cXAI0k+vR3qEbvy0UxEhYAkAocQR2qUTPQ8D1v4lPp59tnHKBGJ0eHt9DYm/SyKkfHsWfqsysZx5NHXSJIhy/SgHwpd8b2q1NKxqBRLrdJKyAua+WWza4p/HMFjEVoN/upZtngSqxUKO/oYqy6m7smkz8vwjzpJR8tyqN881XBQzvryiF/i3ZPFQqlCT9263TMcAGPpym9uvxHzFPPx3u8IDz3AQydyHeViaJhiXGic0VEcm6LMn3JLOYqAzJnv8z89NdpsL4ynv1ekytt/8yyza3CnsU1E4tFDj1HU3785aFZ1xm6wr1MUK9VOTAgMBAAGjZjBkMGIGA1UdAQRbMFmAEN1alzwM3lJSHdh4LFl7uxmhMzAxMS8wLQYDVQQDEyZtYXJnb2NvbnNlaWwuYWNjZXNzY29udHJvbC53aW5kb3dzLm5ldIIQrcBhMtovuJ9MilbEjMjS7TAJBgUrDgMCHQUAA4IBAQAsQ5jNKvS2fLtqs9oB6DGTXdI5nAli5UyvZUQlnfnMvgYjJKrZu79iMe9iu88cmtwZVifG14SRbVdTjUOzngIWAJ5KAQk5t//wSkwgAS+U6AFYI/mee9NLEvOEhrRbpGUP0oL504OZ9zTDeXmGu2FybRB2TvdTKLaeVsBvwqgP33QFkcuPK50fCGC1l3SecIeyWL5fsiw/2+GuTKHjCaeRqnYBgDTINptc9PGayLPBTjs4UPzbccmaYyuanmTAMZGU0iRoGJYet2uAasT52QvWZqD0NUZbWyR1N8CBf5EIW2S/TrpoOBYNgZQU5n9PRJjTBhESHXjfa8RipC8RXU9o&lt;/X509Certificate&gt;
              &lt;/X509Data&gt;
          &lt;/KeyInfo&gt;
      &lt;/ds:Signature&gt;
      &lt;Subject&gt;
          &lt;NameID&gt;***********&lt;/NameID&gt;
          &lt;SubjectConfirmation Method=&quot;urn:oasis:names:tc:SAML:2.0:cm:bearer&quot; /&gt;
      &lt;/Subject&gt;
      &lt;Conditions NotBefore=&quot;2015-06-22T16:16:03.836Z&quot; NotOnOrAfter=&quot;2015-06-22T17:16:03.836Z&quot;&gt;
          &lt;AudienceRestriction&gt;
              &lt;Audience&gt;http://localhost:62569/&lt;/Audience&gt;
          &lt;/AudienceRestriction&gt;
      &lt;/Conditions&gt;
      &lt;AttributeStatement&gt;
          &lt;Attribute Name=&quot;http://schemas.microsoft.com/identity/claims/tenantid&quot;&gt;
              &lt;AttributeValue&gt;********************&lt;/AttributeValue&gt;
          &lt;/Attribute&gt;
          &lt;Attribute Name=&quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name&quot;&gt;
              &lt;AttributeValue&gt;************&lt;/AttributeValue&gt;
          &lt;/Attribute&gt;
          &lt;Attribute Name=&quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname&quot;&gt;
              &lt;AttributeValue&gt;G****l&lt;/AttributeValue&gt;
          &lt;/Attribute&gt;
          &lt;Attribute Name=&quot;http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname&quot;&gt;
              &lt;AttributeValue&gt;L****s&lt;/AttributeValue&gt;
          &lt;/Attribute&gt;
          &lt;Attribute Name=&quot;http://schemas.microsoft.com/identity/claims/identityprovider&quot;&gt;
              &lt;AttributeValue&gt;https://sts.windows.net/7102feaa-34af-4756-85ce-b0f69766d78d/&lt;/AttributeValue&gt;
          &lt;/Attribute&gt;
          &lt;Attribute Name=&quot;http://schemas.microsoft.com/accesscontrolservice/2010/07/claims/identityprovider&quot;&gt;
              &lt;AttributeValue&gt;https://sts.windows.net/7102feaa-34af-4756-85ce-b0f69766d78d/&lt;/AttributeValue&gt;
          &lt;/Attribute&gt;
      &lt;/AttributeStatement&gt;
      &lt;AuthnStatement AuthnInstant=&quot;2015-06-22T14:26:14.020Z&quot;&gt;
          &lt;AuthnContext&gt;
              &lt;AuthnContextClassRef&gt;urn:oasis:names:tc:SAML:2.0:ac:classes:Password&lt;/AuthnContextClassRef&gt;
          &lt;/AuthnContext&gt;
      &lt;/AuthnStatement&gt;
  &lt;/Assertion&gt;
  </code></pre>