Question

I am getting trying to make an Issue request to my STS and I keep getting the following exception:

System.ServiceModel.Security.SecurityNegotiationException' occurred in mscorlib.dll but was not handled in user code

Additional information: Could not establish secure channel for SSL/TLS with authority 'service-location-url-here'.

The following code is running in an asp.net website that is running impersonating my own user account. The STS service requires mutual authentication, therefore I need to send a certificate with my security token request. The server logs are complaining that no certificate is attached to the message, therefore aborting the operation.

Where am I failing here?

public class StsRequestWrapper
{
  public System.IdentityModel.Tokens.SecurityToken RequestSecurityToken()
  {
      IgnoreCertificateValidation();

      StsRequestUtil util = new StsRequestUtil();
      var certificate = util.GetLocalCertificate();
      var securityTokenElement = util.BuildSampleSecurityTokenElement();
      var trustChannelFactory = GetTrustChannelFactory(certificate);

      try
      {
          RequestSecurityToken rst = CreateSecurityTokenObject(securityTokenElement);
          WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();
          RequestSecurityTokenResponse rstr = null;
          return channel.Issue(rst, out rstr);
      }
      finally
      {
          trustChannelFactory.Close();
      }
  }

  private RequestSecurityToken CreateSecurityTokenObject(SecurityTokenElement securityToken)
  {
      RequestSecurityToken rst = new RequestSecurityToken()
      {
          AppliesTo = new EndpointAddress(new Uri(STS_CONSTANTS.APPLIES_TO_URL)),
          ActAs = securityToken,
          RequestType = RequestTypes.Issue,
          Lifetime = new Lifetime(DateTime.UtcNow, DateTime.UtcNow.AddMinutes(5)),
      };

      var requestClaim = new RequestClaim(STS_CONSTANTS.REQUEST_CLAIM_TYPE, false, STS_CONSTANTS.REQUEST_CLAIM_VALUE);
      rst.Claims.Dialect = STS_CONSTANTS.CLAIMS_DIALECT;
      rst.Claims.Add(requestClaim);
      return rst;
  }

  private WSTrustChannelFactory GetTrustChannelFactory(X509Certificate2 localhostCertificate)
  {

      WS2007HttpBinding binding = new WS2007HttpBinding();
      binding.Security.Mode = SecurityMode.Transport;
      binding.Security.Message.ClientCredentialType = MessageCredentialType.Certificate;

      var trustChannelFactory = new WSTrustChannelFactory(binding, new EndpointAddress(new Uri(STS_CONSTANTS.STS_URL)));
      trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;

      trustChannelFactory.Credentials.ClientCertificate.Certificate = localhostCertificate;
      trustChannelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.PeerOrChainTrust;
      trustChannelFactory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;

      return trustChannelFactory;
  }

  private static void IgnoreCertificateValidation()
  {
      System.Net.ServicePointManager.ServerCertificateValidationCallback = ((sender, certificate, chain, sslPolicyErrors) => true);
  }

}

Answer 1

It turns out that I need to use CertificateWSTrustBinding instead of WS2007HttpBinding.

        var binding = new CertificateWSTrustBinding();
        binding.SecurityMode = SecurityMode.Transport;