SecurityKeyType Enum
Definition
Important
Some information relates to prerelease product that may be substantially modified before it’s released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
Specifies the type of key that is associated with a security token.
public enum class SecurityKeyTypepublic enum SecurityKeyTypetype SecurityKeyType = Public Enum SecurityKeyType- Inheritance
Fields
| Name | Value | Description |
|---|---|---|
| SymmetricKey | 0 | Specifies that the key is a symmetric key. |
| AsymmetricKey | 1 | Specifies that the key is an asymmetric key. |
| BearerKey | 2 | Specifies that the security token does not contain a proof-of-possession key. |
Remarks
Use the SecurityKeyType enumeration to set the KeyType property.
The BearerKey field is used with the KeyType property.
BearerKey Requires Wsu:Id or Transport Security with Message Credentials
In federation scenarios, an issued token is generally configured as an endorsing supporting token for message security between a client and the relying parties. However, when a Security Token Service (STS) issues a token with no key (BearerKey), WCF configures it as a SecurityTokenAttachmentMode.SignedEncrypted supporting token (WCF cannot endorse without a key). This requires the issued token to be referenced in the signature. WCF currently uses the following: http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd:Id as a reference mechanism (Wsu:Id).
If an issued token does not have such an attribute, on a client, a MessageSecurityException is thrown with the text "Element to sign must have id". This happens when a SAML 1.1 token is used as an issued token (the Wsu:Id is not defined in the SAML 1.1 specification).
To work around this situation, either use transport security with message credentials (for example, AuthenticationMode.IssuedTokenOverTransport), or an STS must add the http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd:Id (Wsu:Id) to the issued token.
Note that if the Wsu:Id is added to a SAML 1.1 token, the resulting XML does not comply to the SAML 1.1 specification. The alternative is to add a Wsu:Id to the EncryptedData which is a result of encrypting the issued token. This procedure complies with the SAML 1.1 specification, because the EncryptedData element supports the Wsu:Id attribute.
So to be compliant with the specification, the bearer token must be encrypted by the STS.
