public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
 {
     InitiatorServiceModelSecurityTokenRequirement requirement = tokenRequirement as InitiatorServiceModelSecurityTokenRequirement;
     if (requirement != null
         && requirement.TokenType == SecurityTokenTypes.X509Certificate
         && requirement.Properties.ContainsKey(SecurityTokenRequirement.KeyUsageProperty) && (requirement.KeyUsage == SecurityKeyUsage.Exchange))
     {
         X509Certificate2 defaultCertificate = null;
         EndpointAddress targetAddress = requirement.TargetAddress;
         if (targetAddress != null)
         {
             this.ClientCredentials.ServiceCertificate.ScopedCertificates.TryGetValue(targetAddress.Uri, out defaultCertificate);
         }
         if (defaultCertificate == null)
         {
             defaultCertificate = this.ClientCredentials.ServiceCertificate.DefaultCertificate;
         }
         if (((defaultCertificate == null) && (targetAddress.Identity != null)) && (targetAddress.Identity.GetType() == typeof(X509CertificateEndpointIdentity)))
         {
             defaultCertificate = ((X509CertificateEndpointIdentity)targetAddress.Identity).Certificates[0];
         }
         if (defaultCertificate == null)
         {
             isDummyServiceToken = true;
             return new DummySecurityTokenProvider();
         }
         isDummyServiceToken = false;
         return new X509SecurityTokenProvider(defaultCertificate);
     }
     return base.CreateSecurityTokenProvider(tokenRequirement);
 }

        /// <summary>
        /// Creates a security token authenticator based on the <see cref="T:System.IdentityModel.Selectors.SecurityTokenRequirement"/>.
        /// </summary>
        /// <param name="tokenRequirement">The <see cref="T:System.IdentityModel.Selectors.SecurityTokenRequirement"/>.</param>
        /// <param name="outOfBandTokenResolver">When this method returns, contains a <see cref="T:System.IdentityModel.Selectors.SecurityTokenResolver"/>. This parameter is passed uninitialized.</param>
        /// <returns>
        /// The <see cref="T:System.IdentityModel.Selectors.SecurityTokenAuthenticator"/>.
        /// </returns>
        /// <exception cref="T:System.ArgumentNullException">
        /// 	<paramref name="tokenRequirement"/> is null.</exception>
        /// <exception cref="T:System.NotSupportedException">A security token authenticator cannot be created for the<paramref name=" tokenRequirement"/> that was passed in.</exception>
        public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(
            SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
        {
            if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
            {
                outOfBandTokenResolver = null;

                // Get the current validator
                UserNamePasswordValidator validator = ServiceCredentials.UserNameAuthentication.CustomUserNamePasswordValidator;

                // Ensure that a validator exists
                if (validator == null)
                {
                    Trace.TraceWarning("Custom UserName Password Validator must be configued in web.config");

                    validator = new DefaultPersonnelValidator();
                }

                return new PersonnelUserNameTokenAuthenticator(validator);
            }

            // Return your implementation of the SecurityTokenAuthenticator, if required.
            // This implementation delegates to the base class.

            return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
        }

		public SpnegoSecurityTokenAuthenticator (
			ServiceCredentialsSecurityTokenManager manager, 
			SecurityTokenRequirement r)
		{
			this.manager = manager;
			comm = new SpnegoAuthenticatorCommunicationObject (this);
		}

		public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator (
			SecurityTokenRequirement requirement,
			out SecurityTokenResolver outOfBandTokenResolver)
		{
			outOfBandTokenResolver = null;
			if (requirement.TokenType == SecurityTokenTypes.UserName)
				return CreateUserNameAuthenticator (requirement);
			if (requirement.TokenType == SecurityTokenTypes.X509Certificate)
				return CreateX509Authenticator (requirement);
			if (requirement.TokenType == SecurityTokenTypes.Rsa)
				return new RsaSecurityTokenAuthenticator ();
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.SecureConversation) {
				// FIXME: get parameters from somewhere
				SecurityContextSecurityTokenResolver resolver =
					new SecurityContextSecurityTokenResolver (0x1000, true);
				outOfBandTokenResolver = resolver;
				SecurityContextSecurityTokenAuthenticator sc =
					new SecurityContextSecurityTokenAuthenticator ();
				return new SecureConversationSecurityTokenAuthenticator (requirement, sc, resolver);
			}
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.AnonymousSslnego)
				return CreateSslTokenAuthenticator (requirement);
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.MutualSslnego)
				return CreateSslTokenAuthenticator (requirement);
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.Spnego)
				return CreateSpnegoTokenAuthenticator (requirement);
			else
				throw new NotImplementedException ("Not implemented token type: " + requirement.TokenType);
		}

        public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
        {
            if (String.IsNullOrWhiteSpace(tokenRequirement.TokenType) ||
                tokenRequirement.TokenType == SecurityTokenTypes.Saml ||
                tokenRequirement.TokenType == "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1")
            {
                SecurityBindingElement sbe = null;

                if (!tokenRequirement.TryGetProperty<SecurityBindingElement>("http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/SecurityBindingElement", out sbe))
                {
                    throw new InvalidOperationException("Could not retreive the Security Binding Element!");
                }

                // If the token requirement is for a SymmetricKey based token..
                if (tokenRequirement.KeyType != SecurityKeyType.AsymmetricKey) throw new NotSupportedException("Only Asymmetric keys are supported");
                //TODO:Add more

                IssuedSecurityTokenParameters sessionTokenParams = null;
                if (sbe is AsymmetricSecurityBindingElement)
                {
                    sessionTokenParams = (IssuedSecurityTokenParameters) ((AsymmetricSecurityBindingElement)sbe).InitiatorTokenParameters;
                }
                if (sbe is TransportSecurityBindingElement)
                {
                    sessionTokenParams = (IssuedSecurityTokenParameters)((TransportSecurityBindingElement)sbe).EndpointSupportingTokenParameters.Endorsing[0];
                }
                return new SsoSecurityTokenProvider((SsoClientCredentials)ClientCredentials, sessionTokenParams);
            }
            else
            {
                // otherwise use base implementation
                return base.CreateSecurityTokenProvider(tokenRequirement);
            }
        }

		public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator
			(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
		{
			// Return your implementation of the SecurityTokenProvider based on the 
			// tokenRequirement argument.
			SecurityTokenAuthenticator result;
			if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
			{
				MessageDirection direction = tokenRequirement.GetProperty<MessageDirection>
					(ServiceModelSecurityTokenRequirement.MessageDirectionProperty);
				if (direction == MessageDirection.Input)
				{
					outOfBandTokenResolver = null;
					result = new MySecurityTokenAuthenticator();
				}
				else
				{
					result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
				}
			}
			else
			{
				result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
			}

			return result;
		}

        public override SecurityTokenProvider CreateSecurityTokenProvider(
            SecurityTokenRequirement requirement)
        {
            SecurityTokenProvider result = null;
            if (requirement.TokenType == SecurityTokenTypes.X509Certificate)
            {
                var direction = requirement.GetProperty<MessageDirection>(ServiceModelSecurityTokenRequirement.MessageDirectionProperty);

                if (direction == MessageDirection.Output)
                {
                    if (requirement.KeyUsage == SecurityKeyUsage.Signature)
                        result = new X509SecurityTokenProvider(this._credentials.ClientSigningCertificate);
                    else
                        result = new X509SecurityTokenProvider(this._credentials.ServiceEncryptingCertificate);
                }
                else
                {
                    if (requirement.KeyUsage == SecurityKeyUsage.Signature)
                        result = new X509SecurityTokenProvider(this._credentials.ServiceSigningCertificate);
                    else
                        result = new X509SecurityTokenProvider(_credentials.ClientEncryptingCertificate);
                }
            }
            else
            {
                result = base.CreateSecurityTokenProvider(requirement);
            }

            return result;
        }

        /// <summary>
        /// Gets a GenericXmlSecurityToken that wraps the provided issued token
        /// with the authorization policies necessary.
        /// </summary>
        static GenericXmlSecurityToken WrapWithAuthPolicy(GenericXmlSecurityToken issuedToken,
                                                           SecurityTokenRequirement tokenRequirement)
        {
            EndpointIdentity endpointIdentity = null;

            var issuedTokenRequirement = tokenRequirement as InitiatorServiceModelSecurityTokenRequirement;
            if (issuedTokenRequirement != null)
            {
                EndpointAddress targetAddress = issuedTokenRequirement.TargetAddress;
                if (targetAddress.Uri.IsAbsoluteUri)
                {
                    endpointIdentity = EndpointIdentity.CreateDnsIdentity(targetAddress.Uri.DnsSafeHost);
                }
            }

            ReadOnlyCollection<IAuthorizationPolicy> authorizationPolicies
                = GetServiceAuthorizationPolicies(endpointIdentity);

            return new GenericXmlSecurityToken(issuedToken.TokenXml,
                                                issuedToken.ProofToken,
                                                issuedToken.ValidFrom,
                                                issuedToken.ValidTo,
                                                issuedToken.InternalTokenReference,
                                                issuedToken.ExternalTokenReference,
                                                authorizationPolicies);
        }

        public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
        {
            if (tokenRequirement == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("tokenRequirement");
            }

            SecurityTokenProvider result = null;
            if (tokenRequirement is RecipientServiceModelSecurityTokenRequirement && tokenRequirement.TokenType == SecurityTokenTypes.X509Certificate && tokenRequirement.KeyUsage == SecurityKeyUsage.Exchange)
            {
#if FEATURE_CORECLR // X509Certificates
                // this is the uncorrelated duplex case
                if (_parent.ClientCertificate.Certificate == null)
                {
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.ClientCertificateNotProvidedOnClientCredentials)));
                }
                result = new X509SecurityTokenProvider(_parent.ClientCertificate.Certificate);
#endif 
            }
            else if (tokenRequirement is InitiatorServiceModelSecurityTokenRequirement)
            {
                InitiatorServiceModelSecurityTokenRequirement initiatorRequirement = tokenRequirement as InitiatorServiceModelSecurityTokenRequirement;
                string tokenType = initiatorRequirement.TokenType;
                if (IsIssuedSecurityTokenRequirement(initiatorRequirement))
                {
                    throw ExceptionHelper.PlatformNotSupported("CreateSecurityTokenProvider (IsIssuedSecurityTokenRequirement(initiatorRequirement)");
                }
                else if (tokenType == SecurityTokenTypes.X509Certificate)
                {
                    if (initiatorRequirement.Properties.ContainsKey(SecurityTokenRequirement.KeyUsageProperty) && initiatorRequirement.KeyUsage == SecurityKeyUsage.Exchange)
                    {
                        throw ExceptionHelper.PlatformNotSupported("CreateSecurityTokenProvider X509Certificate - SecurityKeyUsage.Exchange");
                    }
                    else
                    {
#if FEATURE_CORECLR
                        if (_parent.ClientCertificate.Certificate == null)
                        {
                            throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidOperationException(SR.Format(SR.ClientCertificateNotProvidedOnClientCredentials)));
                        }
                        result = new X509SecurityTokenProvider(_parent.ClientCertificate.Certificate);
#else 
                        throw ExceptionHelper.PlatformNotSupported("CreateSecurityTokenProvider X509Certificate - Client certificate not supported in UAP");
#endif
                    }
                }
                else if (tokenType == SecurityTokenTypes.UserName)
                {
                    throw ExceptionHelper.PlatformNotSupported("CreateSecurityTokenProvider SecurityTokenTypes.Username");
                }
            }

            if ((result == null) && !tokenRequirement.IsOptionalToken)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new NotSupportedException(SR.Format(SR.SecurityTokenManagerCannotCreateProviderForRequirement, tokenRequirement)));
            }

            return result;
        }

		public SslSecurityTokenAuthenticator (
			ServiceCredentialsSecurityTokenManager manager, 
			SecurityTokenRequirement r)
		{
			this.manager = manager;
			mutual = (r.TokenType == ServiceModelSecurityTokenTypes.MutualSslnego);
			comm = new SslAuthenticatorCommunicationObject (this);
		}

		protected override void InitializeSecurityTokenRequirement (SecurityTokenRequirement requirement)
		{
			if (requirement == null)
				throw new ArgumentNullException ("requirement");
			requirement.TokenType = SecurityTokenTypes.Kerberos;
			requirement.RequireCryptographicToken = true;
			requirement.KeyType = SecurityKeyType.SymmetricKey;
		}

		public void TryGetPropertyTypeMismatch ()
		{
			SecurityTokenRequirement r =
				new SecurityTokenRequirement ();
			r.Properties ["urn:foo"] = 1;
			string s;
			r.TryGetProperty<string> ("urn:foo", out s);
		}

		public void TryGetPropertyTypeBaseMatch ()
		{
			SecurityTokenRequirement r =
				new SecurityTokenRequirement ();
			r.Properties ["urn:foo"] = 1;
			object o;
			r.TryGetProperty<object> ("urn:foo", out o);
		}

            public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
            {
                if (tokenRequirement.TokenType == "RequestedSecurityToken")
                {
                    return new RequestedSecurityTokenProvider(this.Credentials);
                }

                return base.CreateSecurityTokenProvider(tokenRequirement);
            }

 public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
 {
     if (tokenRequirement.TokenType == CreditCardTokenConstants.CreditCardTokenType)
     {
         outOfBandTokenResolver = null;
         return new CreditCardTokenAuthenticator(creditCardServiceCredentials.ValidCreditCards);
     }
     return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
 }

		public void DefaultValues ()
		{
			SecurityTokenRequirement r =
				new SecurityTokenRequirement ();
			Assert.AreEqual (0, r.KeySize, "#1");
			Assert.AreEqual (SecurityKeyType.SymmetricKey, r.KeyType, "#2");
			Assert.AreEqual (SecurityKeyUsage.Signature, r.KeyUsage, "#3");
			Assert.IsNull (r.TokenType, "#4");
			Assert.AreEqual (false, r.RequireCryptographicToken, "#5");
		}

		public SecureConversationSecurityTokenAuthenticator (
			SecurityTokenRequirement r,
			SecurityContextSecurityTokenAuthenticator scAuth,
			SecurityContextSecurityTokenResolver scResolver)
		{
			this.req = r;
			this.sc_auth = scAuth;
			this.sc_res = scResolver;
			comm = new WsscAuthenticatorCommunicationObject ();
		}

        public override System.IdentityModel.Selectors.SecurityTokenAuthenticator CreateSecurityTokenAuthenticator( SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver )
        {
            if ( tokenRequirement.TokenType == Constants.UsernameTokenType )
            {
                outOfBandTokenResolver = null;
                return new SecurityTokenAuthenticator( _serviceCredentials.Validator );
            }

            return base.CreateSecurityTokenAuthenticator( tokenRequirement, out outOfBandTokenResolver );
        }

        /// <summary>
        /// Creates the custom SecurityTokenProvider when SAML tokens are specified in the tokenRequirement
        /// </summary>
        /// <param name="tokenRequirement">A SecurityTokenRequirement  </param>
        /// <returns>The appropriate SecurityTokenProvider</returns>
        public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
        {
            // If token requirement matches SAML token return the custom SAML token provider
            if (tokenRequirement.TokenType == SecurityTokenTypes.Saml ||
                tokenRequirement.TokenType == "http://docs.oasis-open.org/wss/oasis-wss-saml-token-profile-1.1#SAMLV1.1")
            {
                // Retrieve the SAML assertion and proof token from the client credentials
                SamlAssertion assertion = this.samlClientCredentials.Assertion;
                SecurityToken prooftoken = this.samlClientCredentials.ProofToken;

                // If either the assertion of proof token is null...
                if (assertion == null || prooftoken == null)
                {
                    // ...get the SecurityBindingElement and then the specified algorithm suite
                    SecurityBindingElement sbe = null;
                    SecurityAlgorithmSuite sas = null;

                    if (tokenRequirement.TryGetProperty<SecurityBindingElement>("http://schemas.microsoft.com/ws/2006/05/servicemodel/securitytokenrequirement/SecurityBindingElement", out sbe))
                    {
                        sas = sbe.DefaultAlgorithmSuite;
                    }

                    // If the token requirement is for a SymmetricKey based token..
                    if (tokenRequirement.KeyType == SecurityKeyType.SymmetricKey)
                    {
                        // Create a symmetric proof token
                        prooftoken = SamlUtilities.CreateSymmetricProofToken(tokenRequirement.KeySize);
                        // and a corresponding assertion based on the claims specified in the client credentials
                        assertion = SamlUtilities.CreateSymmetricKeyBasedAssertion(this.samlClientCredentials.Claims,
                                                                               new X509SecurityToken(samlClientCredentials.ClientCertificate.Certificate),
                                                                               new X509SecurityToken(samlClientCredentials.ServiceCertificate.DefaultCertificate),
                                                                               (BinarySecretSecurityToken)prooftoken,
                                                                               sas);
                    }
                    // otherwise...
                    else
                    {
                        // Create an asymmetric proof token
                        prooftoken = SamlUtilities.CreateAsymmetricProofToken();
                        // and a corresponding assertion based on the claims specified in the client credentials
                        assertion = SamlUtilities.CreateAsymmetricKeyBasedAssertion(this.samlClientCredentials.Claims, prooftoken, sas);
                    }

                }

                // Create a SamlSecurityTokenProvider based on the assertion and proof token
                return new SamlSecurityTokenProvider(assertion, prooftoken);
            }
            // otherwise use base implementation
            else
            {
                return base.CreateSecurityTokenProvider(tokenRequirement);
            }
        }

 public override SecurityTokenProvider CreateSecurityTokenProvider(SecurityTokenRequirement tokenRequirement)
 {
     if (IsIssuedSecurityTokenRequirement(tokenRequirement))
     {
         return new DurableIssuedSecurityTokenProvider((IssuedSecurityTokenProvider)base.CreateSecurityTokenProvider(tokenRequirement), this.cache);
     }
     else
     {
         return base.CreateSecurityTokenProvider(tokenRequirement);
     }
 }