This documentation is archived and is not being maintained.

SecurityKeyType Enumeration

Specifies the type of key that is associated with a security token.

Namespace:  System.IdentityModel.Tokens
Assembly:  System.IdentityModel (in System.IdentityModel.dll)

public enum SecurityKeyType

Member nameDescription
SymmetricKeySpecifies that the key is a symmetric key.
AsymmetricKeySpecifies that the key is an asymmetric key.
BearerKeySpecifies that the security token does not contain a proof-of-possession key.

Use the SecurityKeyType enumeration to set the KeyType property.

The BearerKey field is used with the KeyType property.

BearerKey Requires Wsu:Id or Transport Security with Message Credentials

In federation scenarios, an issued token is generally configured as an endorsing supporting token for message security between a client and the relying parties. However, when a Security Token Service (STS) issues a token with no key (BearerKey), configures it as a SignedEncrypted supporting token ( cannot endorse without a key). This requires the issued token to be referenced in the signature. currently uses the following: as a reference mechanism (Wsu:Id).

If an issued token does not have such an attribute, on a client, a MessageSecurityException is thrown with the text "Element to sign must have id". This happens when a SAML 1.1 token is used as an issued token (the Wsu:Id is not defined in the SAML 1.1 specification).

To work around this situation, either use transport security with message credentials (for example, IssuedTokenOverTransport) or an STS must add the (Wsu:Id) to the issued token.

Note that if the Wsu:Id is added to a SAML 1.1 token, the resulting XML does not comply to the SAML 1.1 specification. The alternative is to add a Wsu:Id to the EncryptedData which is a result of encrypting the issued token. This procedure complies with the SAML 1.1 specification, because the EncryptedData element supports the Wsu:Id attribute.

So to be compliant with the specification, the bearer token must be encrypted by the STS.

.NET Framework

Supported in: 4, 3.5, 3.0

.NET Framework Client Profile

Supported in: 4, 3.5 SP1

Windows 7, Windows Vista SP1 or later, Windows XP SP3, Windows Server 2008 (Server Core not supported), Windows Server 2008 R2 (Server Core supported with SP1 or later), Windows Server 2003 SP2

The .NET Framework does not support all versions of every platform. For a list of the supported versions, see .NET Framework System Requirements.