• https://blogs.msdn.microsoft.com/distributedservices/2012/10/29/wif-1-0-id1073-a-cryptographicexception-occurred-when-attempting-to-decrypt-the-cookie-using-the-protecteddata-api/
• https://blogs.msdn.microsoft.com/napegadie_kones_msft_blog/2016/01/19/cryptographicexception-key-not-valid-for-use-in-specified-state/

<securityTokenHandlers>

    <remove type="SessionSecurityTokenHandler"/> 

    <add type="MachineKeySessionSecurityTokenHandler" /> 

</securityTokenHandlers>

<securityTokenHandlers>

 <clear/>

    <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />

    <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />

</securityTokenHandlers>

<System.IdentityModel>
     <identityConfiguration>
          <securityTokenHandlers>
               <remove type="System.IdentityModel.Tokens.SessionSecurityTokenHandler, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
               <add type="System.IdentityModel.Services.Tokens.MachineKeySessionSecurityTokenHandler, System.IdentityModel.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
          </securityTokenHandlers>
     </identityConfiguration>
</System.IdentityModel>

• Small [1-5 computers]
• Medium [6-15 computers]
• Large [> 15 computers]

1. Launch VS 2012 as an administrator, and create a "WCF Service Application".
2. Make your service ready with business logic.
3. Right click on the project/ go to Properties/ go to Web tab/ Create virtual directory/ Deploy to IIS.
4. Ensure the WCF service is accessible over https.
5. Right click on the project, and go to "Identity and Access tool".
6. Point to ADFS metadata URL and APP ID URL.

7. Let's go to "web.config"
8. Ensure to have the following configuration under System.IdentityModel.

<system.identityModel>
   <identityConfiguration saveBootstrapContext="true">
   <audienceUris>
       <add value="https://aadconnect.contoso.com/Issuedtokenmixedasymmetricbasic256WcfService1/Service1.svc" />
       <add value="https://test1.com/"/>
   </audienceUris>
   <issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
       <authority name="adfs.contoso.com/adfs/services/trust">
           <keys>
               <add thumbprint="567845870C8A0D9BA17503B3B14EC604B95F41AF" />
           </keys>
           <validIssuers>
                <add name="adfs.contoso.com/adfs/services/trust" />
           </validIssuers>
       </authority>
   </issuerNameRegistry>
   <!--certificationValidationMode set to "None" by the the Identity and Access Tool for Visual Studio. For development purposes.-->
   <certificateValidation certificateValidationMode="None" />
</identityConfiguration>
</system.identityModel>

9. Update the System.ServiceModel section with "ws2007FederationHttpBinding" for the WCF service endpoint.

<system.serviceModel>
    <behaviors>
        <serviceBehaviors>
            <behavior>
                <!-- To avoid disclosing metadata information, set the values below to false before deployment -->
                <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true" />
                <!-- To receive exception details in faults for debugging purposes, set the value below to true. Set to false before deployment to avoid disclosing exception information -->
                <serviceDebug includeExceptionDetailInFaults="false" />
                <serviceCredentials useIdentityConfiguration="true">
                     <!--Certificate added by Identity and Access Tool for Visual Studio.-->
                     <serviceCertificate findValue="CN=localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName" />
                </serviceCredentials>
            </behavior>
        </serviceBehaviors>
     </behaviors>
     <protocolMapping>
          <add scheme="https" binding="ws2007FederationHttpBinding" />
     </protocolMapping>
     <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
     <bindings>
     <ws2007FederationHttpBinding>
       <binding>
         <security mode="TransportWithMessageCredential">
           <message issuedKeyType="BearerKey">
             <issuerMetadata address="https://adfs.contoso.com/adfs/services/trust/mex" />
           </message>
         </security>
       </binding>
     </ws2007FederationHttpBinding>
     </bindings>
</system.serviceModel>

10. Ensure WCF service URL is accessible over browser, and https.

1. Using "UserNameWSTrustBinding", client gets token from "usernamemixed" ADFS endpoint.
2. Using "IssuedTokenWSTrustBinding", client presents the above token to "issuedtokenmixedsymmetricbasic256" ADFS endpoint, and gets a token in response.
3. Using "WS2007FederationHttpBinding", the token is presented during the WCF service operation call.

1. Create a console application.
2. "Add service reference" to your WCF service endpoint.
3. Update your "App.config" with the following appSettings.

<appSettings>
    <add key="usernamemixedEP" value="https://adfs.contoso.com/adfs/services/trust/13/usernamemixed"/>
    <add key="usernamemixedAppliesTo" value="https://Test.com/"/>
    <!-- You can enable any of the following issuedToken based ADFS endpoints. -->
    <!-- https://adfs.contoso.com/adfs/services/trust/13/issuedtokenmixedsymmetricbasic256 -->
    <!-- https://adfs.contoso.com/adfs/services/trust/13/issuedtokenmixedsymmetricbasic256sha256 -->
    <!-- https://adfs.contoso.com/adfs/services/trust/13/issuedtokenmixedasymmetricbasic256 -->
    <!-- https://adfs.contoso.com/adfs/services/trust/13/issuedtokenmixedasymmetricbasic256sha256 -->
    <add key="issuedtokenEP" value="https://adfs.contoso.com/adfs/services/trust/13/issuedtokenmixedasymmetricbasic256"/> 
    <add key="issuedtokenAppliesTo" value="https://test1.com/"/>
    <!-- Set false if SAML 2.0 Assertion expected. Otherwise, let it be true. -->
    <add key="saml10TokenType" value="false"/>
    <add key="username" value="JohnAdmin@contoso.com"/>
    <add key="password" value="Password01!"/>
    <add key="serviceEpAddress" value="https://aadconnect.contoso.com/Issuedtokenmixedasymmetricbasic256WcfService1/Service1.svc"/>
</appSettings>

4. The program should be updated with the following source code.

		    class Program
		    {
		        static void Main(string[] args)
		        {
		            var tokenType = ConfigurationManager.AppSettings["saml10TokenType"].ToString();
		            bool isSAML10Token;
		            Boolean.TryParse(tokenType, out isSAML10Token);
		            if (isSAML10Token)
		            {
		                tokenType = "urn:oasis:names:tc:SAML:1.0:assertion";
		            }
		            else
		            {
		                tokenType = "urn:oasis:names:tc:SAML:2.0:assertion";
		            }
		
		            var usernameToken = GetIdentityProviderToken(tokenType);
		
		            var issuedToken = GetRSTSToken(usernameToken, tokenType);
		
		            var serviceResponse = CallService_IssuedToken(issuedToken);
		
		            Console.WriteLine(serviceResponse);
		            Console.ReadLine();
                        }

		        private static SecurityToken GetIdentityProviderToken(string tokenType)
		        {
		            var binding = new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential);
		
		            var factory = new WSTrustChannelFactory(binding, ConfigurationManager.AppSettings["usernamemixedEP"].ToString())
		            {
		                TrustVersion = TrustVersion.WSTrust13
		            };
		
		            factory.Credentials.UserName.Password = ConfigurationManager.AppSettings["password"].ToString();
		            factory.Credentials.UserName.UserName = ConfigurationManager.AppSettings["username"].ToString();
		            factory.Credentials.SupportInteractive = false;
		            factory.Credentials.UseIdentityConfiguration = true;
		
		            var rst = new RequestSecurityToken
		            {
		                RequestType = "docs.oasis-open.org/ws-sx/ws-trust/200512/Issue",
		                AppliesTo = new EndpointReference(ConfigurationManager.AppSettings["usernamemixedAppliesTo"].ToString()),
		                KeyType = "docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey",
		                TokenType = tokenType
		            };
		
		            var channel = factory.CreateChannel();
		            return channel.Issue(rst);
		        }

      		        private static SecurityToken GetRSTSToken(SecurityToken token, string tokenType)
		        {
		            var binding = new IssuedTokenWSTrustBinding();
		            binding.SecurityMode = SecurityMode.TransportWithMessageCredential;
		
		            var issuredTokenEP = ConfigurationManager.AppSettings["issuedtokenEP"].ToString();
		            if (issuredTokenEP.ToLower().EndsWith("issuedtokenmixedasymmetricbasic256sha256")
		                || issuredTokenEP.ToLower().EndsWith("issuedtokenmixedsymmetricbasic256sha256"))
		            {
		                binding.AlgorithmSuite = SecurityAlgorithmSuite.Basic256Sha256;
		            }
		
		            var factory = new WSTrustChannelFactory(binding, issuredTokenEP);
		            factory.TrustVersion = TrustVersion.WSTrust13;
		            factory.Credentials.SupportInteractive = false;
		            factory.Credentials.UseIdentityConfiguration = true;
		            
		            var rst = new RequestSecurityToken
		            {
		                RequestType = "docs.oasis-open.org/ws-sx/ws-trust/200512/Issue",
		                AppliesTo = new EndpointReference(ConfigurationManager.AppSettings["issuedtokenAppliesTo"].ToString()),
		                KeyType = "docs.oasis-open.org/ws-sx/ws-trust/200512/Bearer",
		                TokenType = tokenType,
		            };
		
		            var channel = factory.CreateChannelWithIssuedToken(token);
		
		            return channel.Issue(rst);
		        }
  
		        private static string CallService_IssuedToken(SecurityToken token)
		        {
		            // Creating the channel and calling it
		            var binding = new WS2007FederationHttpBinding(WSFederationHttpSecurityMode.TransportWithMessageCredential);
		            binding.Security.Message.IssuedKeyType = SecurityKeyType.BearerKey;
		
		            var serviceEpAddress = ConfigurationManager.AppSettings["serviceEpAddress"].ToString();
		            var factory = new ChannelFactory(binding, new EndpointAddress(serviceEpAddress));
		            
		            // Create a channel
		            IService1 client = factory.CreateChannelWithIssuedToken(token);
		            
		            // Invoke the service operation
		            var response = client.GetData(12);
		            ((IClientChannel)client).Close();
		
		            return response;
		        }		
                     }

5. The bindings such as UserNameWSTrustBinding and IssuedTokenWSTrustBinding are part of WIF V1, i.e. Microsoft.IdentityModel. So, the trick is to port the old code in your application explicitly.
6. To keep safe of length of this document, I am not putting the whole code. I would attach the whole source code on OneDrive for reference.

1. Launch VS 2015 as an administrator
2. Create a new project with "WCF service application" template
3. Let it be named "ActiveScenarioService2015"
4. Modify "Iservice1.cs" to contain the following methods:

		
		using System.ServiceModel;

		namespace ActiveScenarioService2015
		{
			[ServiceContract]
			public interface IService1
			{
				[OperationContract]
				string GetData(int value);

				[OperationContract]
				string GetClaim();
			}
		}

5. Modify "Service1.svc.cs" to contain the following code:

		
		using System.Security.Claims;
		using System.ServiceModel;
		using System.Text;

		namespace ActiveScenarioService2015
		{
			public class Service1 : IService1
			{
				public string GetData(int value)
				{
					return string.Format("You entered: {0}", value);
				}

				public string GetClaim()
				{
					ClaimsPrincipal claimsPrincipal = OperationContext.Current.ClaimsPrincipal;

					StringBuilder builder = new StringBuilder();

					builder.AppendLine(string.Format("User identity: {0}", claimsPrincipal.Identity.Name));
					foreach (var claim in claimsPrincipal.Claims)
					{
						builder.AppendLine(string.Format("Claim Type: {0} Claim Value: {1}", claim.Type, claim.Value));
					}

					return builder.ToString();
				}
			}
		}

6. Ensure you can build the project fine
7. Add reference to assemblies such as "System.IdentityModel" and "System.IdentityModel.Services"
8. Manage Nuget packages -> find "System.IdentityModel.Tokens.ValidatingIssuerNameRegistry" -> "Install"
9. Modify the "web.config" to contain the following configuration items:

	
	<configuration>
	  <configSections>
		<section name="system.identityModel" type="System.IdentityModel.Configuration.SystemIdentityModelSection, System.IdentityModel, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
	  </configSections>
	  <appSettings>
		<add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" />
		<add key="ida:FederationMetadataLocation" value="https://adfs.contoso.com/federationmetadata/2007-06/federationmetadata.xml" />
		<add key="ida:ProviderSelection" value="productionSTS" />
	  </appSettings>
	  <system.web>
		<compilation debug="true" targetFramework="4.6.1" />
		<httpRuntime targetFramework="4.6.1"/>
	  </system.web>
	  <system.serviceModel>
		<behaviors>
		  <serviceBehaviors>
			<behavior>
			  <serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
			  <serviceDebug includeExceptionDetailInFaults="true"/>
			  <serviceCredentials useIdentityConfiguration="true">
				<serviceCertificate findValue="CN=localhost" storeLocation="LocalMachine" storeName="My" x509FindType="FindBySubjectDistinguishedName"/>
			  </serviceCredentials>
			</behavior>
		  </serviceBehaviors>
		</behaviors>
		<protocolMapping>
			<add binding="ws2007FederationHttpBinding" scheme="https" />
		</protocolMapping>
		<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
		<bindings>
		  <ws2007FederationHttpBinding>
			<binding>
			  <security mode="TransportWithMessageCredential">
				<message>
				  <issuerMetadata address="https://adfs.contoso.com/adfs/services/trust/mex" />
				</message>
			  </security>
			</binding>
		  </ws2007FederationHttpBinding>
		</bindings>
	  </system.serviceModel>
	  <system.webServer>
		<modules runAllManagedModulesForAllRequests="true"/>
		
		<directoryBrowse enabled="true"/>
	  </system.webServer>
	  <system.identityModel>
		  <identityConfiguration>
			<audienceUris>
			  <add value="https://win7.contoso.com/ActiveScenarioService2015/Service1.svc" />
			</audienceUris>
			<issuerNameRegistry type="System.IdentityModel.Tokens.ValidatingIssuerNameRegistry, System.IdentityModel.Tokens.ValidatingIssuerNameRegistry">
			  <authority name="adfs.contoso.com/adfs/services/trust">
				<keys>
				  <add thumbprint="BDF5186BFF80A2BC188508F4EEE0E5737CBCD30E" />
				</keys>
				<validIssuers>
				  <add name="adfs.contoso.com/adfs/services/trust" />
				</validIssuers>
			  </authority>
			</issuerNameRegistry>
			
			<certificateValidation certificateValidationMode="None" />
		</identityConfiguration>
	  </system.identityModel>
	</configuration>

10. Please note about two applications over here
    1. "CN=localhost"
       • you can launch your certificate store (run -> mmc -> add/ remove snap in/ certificates/ Add .. Select "Computer Account"/ OK
       • you would see a certificate named "localhost" in your "personal" store
       • if not, create a self-signed certificate with "localhost" name form IIS manager
11. 2. "BDF5186BFF80A2BC188508F4EEE0E5737CBCD30E"
       • it would be the thumbprint value of your "ADFS signing" certificate

11. Host the WCF service on IIS
12. One simple method is just to create virtual directory via VS project properties

13. Go to IIS Manager/ Create an application pool for "v4.0" .NET framework named as "ActiveScenarioService2015" (for example)
14. Ensure "Load User Profile" set to "true" for the application pool
15. Map the IIS hosted application "ActiveScenarioService2015" to the newly created application pool "ActiveScenarioService2015"
16. Ensure you can browse your service application fine (for example - https://win7.contoso.com/ActiveScenarioService2015/Service1.svc)

17. Next step is to provision the service application on ADFS (in this case - it was 3.0)
18. On the IIS server "win7.conrtoso.com", Right click the "localhost" certificate in store, "All Tasks" -> "Export" .. Without private key -> to a DER encoded binary X.509 certificate (.CER) file
19. Go to your ADFS server, and bring in the ".CER" for being used as "encryption" certificate
20. Ensure ADFS "usernamemixed" endpoint is enabled
21. Add "Relying Party Trust"

22. Now, "RP Trust" provisioning is over in ADFS

23. Next, it is turn of the client side to be ready

24. Create an MVC web application project named "ActiveScenarioWebClient" in VS 2015
25. Ensure you can build the web application project fine
26. "Add Service Reference" to the WCF service URL https://win7.contoso.com/ActiveScenarioService2015/Service1.svc
27. Build the project
28. Now, turn to "web.confg" and ensure following sections appended or appeared in <system.serviceModel .. /> section

  <system.serviceModel>
    <bindings>
      <basicHttpBinding>
        <binding name="BasicHttpBinding_IService1" />
      </basicHttpBinding>
      <wsHttpBinding>
        <binding name="https://adfs.contoso.com/adfs/services/trust/2005/certificatemixed">
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="None" />
            <message clientCredentialType="Certificate" establishSecurityContext="false" />
          </security>
        </binding>
        <binding name="https://adfs.contoso.com/adfs/services/trust/2005/usernamemixed">
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="None" />
            <message clientCredentialType="UserName" establishSecurityContext="false" />
          </security>
        </binding>
        <binding name="https://adfs.contoso.com/adfs/services/trust/13/windowstransport">
          <security mode="Transport" />
        </binding>
      </wsHttpBinding>
      <ws2007HttpBinding>
        <binding name="https://adfs.contoso.com/adfs/services/trust/13/certificatemixed">
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="None" />
            <message clientCredentialType="Certificate" establishSecurityContext="false" />
          </security>
        </binding>
        <binding name="https://adfs.contoso.com/adfs/services/trust/13/usernamemixed">
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="None" />
            <message clientCredentialType="UserName" establishSecurityContext="false" />
          </security>
        </binding>
      </ws2007HttpBinding>
      <ws2007FederationHttpBinding>
        <binding name="WS2007FederationHttpBinding_IService1_username">
          <security mode="TransportWithMessageCredential">
            <message>
              <issuer address="https://adfs.contoso.com/adfs/services/trust/2005/usernamemixed"
                binding="wsHttpBinding" bindingConfiguration="https://adfs.contoso.com/adfs/services/trust/2005/usernamemixed">
              </issuer>
              <issuerMetadata address="https://adfs.contoso.com/adfs/services/trust/mex" />
              <tokenRequestParameters>
                <trust:SecondaryParameters xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">
                  <trust:KeyType xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType>
                  <trust:KeySize xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">256</trust:KeySize>
                  <trust:KeyWrapAlgorithm xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</trust:KeyWrapAlgorithm>
                  <trust:EncryptWith xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptWith>
                  <trust:SignWith xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">www.w3.org/2000/09/xmldsig#hmac-sha1</trust:SignWith>
                  <trust:CanonicalizationAlgorithm xmlns:trust="docs.oasis-open.org/ws-sx/ws-trust/200512">www.w3.org/2001/10/xml-exc-c14n#www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
                </trust:SecondaryParameters>
              </tokenRequestParameters>
            </message>
          </security>
        </binding>
      </ws2007FederationHttpBinding>
    </bindings>
    <client>
      <endpoint address="win7.contoso.com/ActiveScenarioService2015/Service1.svc"
        binding="basicHttpBinding" bindingConfiguration="BasicHttpBinding_IService1"
        contract="ServiceReference1.IService1" name="BasicHttpBinding_IService1" />
      <endpoint address="https://win7.contoso.com/ActiveScenarioService2015/Service1.svc"
        binding="customBinding" bindingConfiguration="WS2007FederationHttpBinding_IService1"
        contract="ServiceReference1.IService1" name="WS2007FederationHttpBinding_IService1" />
      <endpoint address="https://win7.contoso.com/ActiveScenarioService2015/Service1.svc"
        binding="ws2007FederationHttpBinding" bindingConfiguration="WS2007FederationHttpBinding_IService1_username"
        contract="ServiceReference1.IService1" name="WS2007FederationHttpBinding_IService1_username" />
    </client>
  </system.serviceModel>

29. 29. Create a controller named "TestController"

	using ActiveScenarioWebClient.ServiceReference1;
	using System;
	using System.Collections.Generic;
	using System.Linq;
	using System.Web;
	using System.Web.Mvc;

	namespace ActiveScenarioWebClient.Controllers
	{
		public class TestController : Controller
		{
			// GET: Test
			public ActionResult Index()
			{
				var proxy = new Service1Client("WS2007FederationHttpBinding_IService1_username");
				proxy.ClientCredentials.UserName.UserName = @"contoso\administrator";
				proxy.ClientCredentials.UserName.Password = "Password01!";
				var response = proxy.GetClaim();
				ViewBag.Response = response;
				proxy.Close();

				return View();
			}
		}
	}

30. 30. Add view "Index.cshtml"

    @{
          ViewBag.Title = "Index";
          }
 
          <h2>Index</h2>
          <p>@ViewBag.Response</p>

31. Host the web application on IIS
32. Access your web application over browser (e.g. https://aadconnect.contoso.com/ActiveScenarioWebClient/test)
33. The output would be something like

34. Once we have this much output, we are good with the authentication flow