Wcf: Cannot find a token authenticator

Follow @YaronNaveh

The below is a common error with Wcf clients in security interoperability scenarios:

Cannot find a token authenticator for the 'System.IdentityModel.Tokens.X509SecurityToken' token type. Tokens of that type cannot be accepted according to current security settings.

What does it mean?

When a signed response comes back from the server it has two ways to reference the signing certificate.

Option A (key identifier):

<o:BinarySecurityToken wsu:Id=”uuid-a687c39f-f848-481b-8552-35de5b5a4d51-2”>  
MQ+PASL89QWEQW2367ASDDASjn7812ASDDAS781mFSDJK78…</o:BinarySecurityToken>  
  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">  
    <SignedInfo>  
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod>  
      <SignatureMethod Algorithm="...rsa-sha1"></SignatureMethod>  
       …  
    </SignedInfo>  
    <SignatureValue>tWTQzQhKg3zJb75P4sUfMPa3...</SignatureValue>  
    <KeyInfo>  
      <o:SecurityTokenReference>  
        <o:KeyIdentifier ValueType="...#X509SubjectKeyIdentifier" EncodingType="...#Base64Binary">gBfL0123lM6cUV5YA4=</wsse:KeyIdentifier> 
      </o:SecurityTokenReference>  
    </KeyInfo>  
</Signature> 

Option B (direct reference):

<o:BinarySecurityToken wsu:Id=”uuid-a687c39f-f848-481b-8552-35de5b5a4d51-2”>  
MQ+PASL89QWEQW2367ASDDASjn7812ASDDAS781mFSDJK78…</o:BinarySecurityToken>  
  <Signature xmlns="http://www.w3.org/2000/09/xmldsig#">  
    <SignedInfo>  
      <CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#"></CanonicalizationMethod>  
      <SignatureMethod Algorithm="...rsa-sha1"></SignatureMethod>  
       …  
    </SignedInfo>  
    <SignatureValue>tWTQzQhKg3zJb75P4sUfMPa3...</SignatureValue>  
    <KeyInfo>  
      <o:SecurityTokenReference>  
        <o:Reference ValueType="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-x509-token-profile-1.0#X509v3" URI="#uuid-a687c39f-f848-481b-8552-35de5b5a4d51-2"></o:Reference>  
      </o:SecurityTokenReference>  
    </KeyInfo>  
</Signature>

The above error means that the response has key identifier but the client is configured to require a direct reference.

How to fix it?

On your client, configure allowSerializedSigningTokenOnReply to true:

<customBinding> 
  <binding> 
    ...
    <security allowSerializedSigningTokenOnReply="true" /> 
    ...
  </binding> 
<customBinding>

An alternative can be to build a custom message encoder which changes the response from option B to A. This is possible since we know what is the certificate (using the reference) so we can create the binary token. Of course this alternative is much harder and in the general case the former should be preferred.

Follow @YaronNaveh

What's next? get this blog rss updates or register for mail updates!