Question

I am trying to use WS2007HttpRelayBinding with end to end security mode set to TransportWithMessageCredential. I am using IssuedToken as the credential type. I get the token from a ADFS 2.0 one calling the service I get the following in the on premises wcf trace log

Cannot find a token authenticator for the ‘Microsoft.IdentityModel.Tokens.Saml2.Saml2SecurityToken’ token type. Tokens of that type cannot be accepted according to current security settings.

update:
This is how I am configuring the service host

ServiceConfiguration serviceConfiguration = new ServiceConfiguration();

            serviceConfiguration.ServiceCertificate = GetServiceCertificateWithPrivateKey();


            serviceConfiguration.CertificateValidationMode = X509CertificateValidationMode.None;


            serviceConfiguration.IssuerNameRegistry = new X509IssuerNameRegistry("localhost");


            serviceConfiguration.SaveBootstrapTokens = true;


            serviceConfiguration.SecurityTokenHandlers.AddOrReplace(new Saml2SecurityTokenHandler());


            serviceConfiguration.SecurityTokenHandlers.Configuration.AudienceRestriction.AllowedAudienceUris.Add(new Uri("https://mynamespace.servicebus.windows.net/Service1/"));



            FederatedServiceCredentials.ConfigureServiceHost(host, serviceConfiguration);

            host.Open();

Answer 1

The binding security elements is set to look for SAML 1.1 tokens. I added the following code to the server after constructing the ‘CustomBinding’ element

IssuedSecurityTokenParameters issuedTokenParameters = 
            myBinding.Elements.Find<TransportSecurityBindingElement>().EndpointSupportingTokenParameters.Endorsing[0] as IssuedSecurityTokenParameters;
        issuedTokenParameters.TokenType = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0";