I have built my own security token service for test purposes. I now wish to use Azure to issue SAML2 tokens under WS-Trust. For simplicity I'm using the Microsoft ACS Samples to illustrate my issue.
I have set up a Relying Party in ACS and configured ALL of the associated token signing and encrypting certificates. When I request a token using the following standard code:
static void GetTokenFromAzure2() {
string acsCertificateEndpoint = String.Format("https://{0}.{1}/v2/wstrust/13/certificate", SamplesConfiguration.ServiceNamespace, SamplesConfiguration.AcsHostUrl);
var address = new EndpointAddress(new Uri(acsCertificateEndpoint), EndpointIdentity.CreateDnsIdentity(GetServiceCertificateSubjectName()));
WSTrustChannelFactory trustChannelFactory = new WSTrustChannelFactory(new CertificateWSTrustBinding(SecurityMode.Transport), address);
trustChannelFactory.TrustVersion = TrustVersion.WSTrust13;
trustChannelFactory.Credentials.ServiceCertificate.DefaultCertificate = GetServiceCertificate();
trustChannelFactory.Credentials.ClientCertificate.Certificate = GetClientCertificateWithPrivateKey();
trustChannelFactory.Credentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;
trustChannelFactory.Credentials.ServiceCertificate.Authentication.RevocationMode = X509RevocationMode.NoCheck;
trustChannelFactory.Endpoint.Behaviors.Add(new InspectorBehavior());
//trustChannelFactory.ConfigureChannelFactory();
try {
var request = new RequestSecurityToken(RequestTypes.Issue) {
AppliesTo = new EndpointReference(ServiceAddress),
TokenType = "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV2.0"
};
WSTrustChannel channel = (WSTrustChannel)trustChannelFactory.CreateChannel();
RequestSecurityTokenResponse rstr = null;
SecurityToken token = channel.Issue(request, out rstr);
}
finally {
trustChannelFactory.Close();
}
}
I keep getting the following error: ACS10001: An error occurred while processing the SOAP header. I have wrote message inspectors so that I can view the outgoing RST request and all is fine. I have even tried with different clients using Ruby and NodeJS and I get the same error from Azure. I have checked and my code works with other configured Security Token Servers. I can't understand why this will not work with Azure and Google does show that a few people also have this error but no solution. Please can anybody help me.