public static void Validate(SecurityTokenReferenceStyle value)
 {
     if (!IsDefined(value))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new InvalidEnumArgumentException("value", (int) value, typeof(SecurityTokenReferenceStyle)));
     }
 }

        protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause( System.IdentityModel.Tokens.SecurityToken token, SecurityTokenReferenceStyle referenceStyle )
        {
            if ( referenceStyle == SecurityTokenReferenceStyle.Internal )
                return token.CreateKeyIdentifierClause<LocalIdKeyIdentifierClause>();

            throw new NotSupportedException( "External references are not supported for tokens" );
        }

 internal protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
 {
     if (token is GenericXmlSecurityToken)
         return base.CreateGenericXmlTokenKeyIdentifierClause(token, referenceStyle);
     else
         return this.CreateKeyIdentifierClause<SecurityContextKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
 }

 protected internal override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
 {
     if (referenceStyle == SecurityTokenReferenceStyle.Internal)
     {
         return token.CreateKeyIdentifierClause<LocalIdKeyIdentifierClause>();
     }
     return null;
 }

 public static bool IsDefined(SecurityTokenReferenceStyle value)
 {
     if (value != SecurityTokenReferenceStyle.External)
     {
         return (value == SecurityTokenReferenceStyle.Internal);
     }
     return true;
 }

        internal protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
        {
            SecurityKeyIdentifierClause result = null;

            switch (this.x509ReferenceStyle)
            {
                default:
                case X509KeyIdentifierClauseType.Any:
                    if (referenceStyle == SecurityTokenReferenceStyle.External)
                    {
                        X509SecurityToken x509Token = token as X509SecurityToken;
                        if (x509Token != null)
                        {
                            X509SubjectKeyIdentifierClause x509KeyIdentifierClause;
                            if (X509SubjectKeyIdentifierClause.TryCreateFrom(x509Token.Certificate, out x509KeyIdentifierClause))
                            {
                                result = x509KeyIdentifierClause;
                            }
                        }
                        else
                        {
                            X509WindowsSecurityToken windowsX509Token = token as X509WindowsSecurityToken;
                            if (windowsX509Token != null)
                            {
                                X509SubjectKeyIdentifierClause x509KeyIdentifierClause;
                                if (X509SubjectKeyIdentifierClause.TryCreateFrom(windowsX509Token.Certificate, out x509KeyIdentifierClause))
                                {
                                    result = x509KeyIdentifierClause;
                                }
                            }
                        }

                        if (result == null)
                            result = token.CreateKeyIdentifierClause<X509IssuerSerialKeyIdentifierClause>();
                        if (result == null)
                            result = token.CreateKeyIdentifierClause<X509ThumbprintKeyIdentifierClause>();
                    }
                    else
                        result = token.CreateKeyIdentifierClause<LocalIdKeyIdentifierClause>();
                    break;
                case X509KeyIdentifierClauseType.Thumbprint:
                    result = this.CreateKeyIdentifierClause<X509ThumbprintKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
                    break; 
                case X509KeyIdentifierClauseType.SubjectKeyIdentifier:
                    result = this.CreateKeyIdentifierClause<X509SubjectKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
                    break;
                case X509KeyIdentifierClauseType.IssuerSerial:
                    result = this.CreateKeyIdentifierClause<X509IssuerSerialKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
                    break;
                case X509KeyIdentifierClauseType.RawDataKeyIdentifier:
                    result = this.CreateKeyIdentifierClause<X509RawDataKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
                    break;
            }

            return result;
        }

		protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause (
			SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
		{
			if (token == null)
				throw new ArgumentNullException ("token");
			RsaSecurityToken rt = token as RsaSecurityToken;
			if (rt == null)
				throw new NotSupportedException (String.Format ("Cannot create a key identifier clause from this security token '{0}'", token));
			return new RsaKeyIdentifierClause (rt.Rsa);
		}

 protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
 {
     if (referenceStyle == SecurityTokenReferenceStyle.Internal)
     {
         return token.CreateKeyIdentifierClause<LocalIdKeyIdentifierClause>();
     }
     else
     {
         throw new NotSupportedException("External references are not supported for credit card tokens");
     }
 }

		protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause (
			SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
		{
			if (token == null)
				throw new ArgumentNullException ("token");
			if (token is UserNameSecurityToken &&
			    referenceStyle == SecurityTokenReferenceStyle.Internal)
				return new LocalIdKeyIdentifierClause (token.Id);
			// External reference is not supported.
			throw new NotSupportedException (String.Format ("This security token '{0}' with {1} reference mode is not supported.", token, referenceStyle));
		}

 protected internal override bool MatchesKeyIdentifierClause(SecurityToken token, SecurityKeyIdentifierClause keyIdentifierClause, SecurityTokenReferenceStyle referenceStyle)
 {
     if (referenceStyle != SecurityTokenReferenceStyle.Internal)
     {
         return false;
     }
     LocalIdKeyIdentifierClause clause = keyIdentifierClause as LocalIdKeyIdentifierClause;
     if (clause == null)
     {
         return false;
     }
     return (clause.LocalId == token.Id);
 }

 private WrappedKeySecurityToken CreateWrappedKeyToken(SecurityToken wrappingToken, SecurityTokenParameters wrappingTokenParameters, SecurityTokenReferenceStyle wrappingTokenReferenceStyle)
 {
     int keyLength = Math.Max(0x80, this.Factory.OutgoingAlgorithmSuite.DefaultSymmetricKeyLength);
     CryptoHelper.ValidateSymmetricKeyLength(keyLength, this.Factory.OutgoingAlgorithmSuite);
     byte[] buffer = new byte[keyLength / 8];
     CryptoHelper.FillRandomBytes(buffer);
     string id = System.ServiceModel.Security.SecurityUtils.GenerateId();
     string defaultAsymmetricKeyWrapAlgorithm = this.Factory.OutgoingAlgorithmSuite.DefaultAsymmetricKeyWrapAlgorithm;
     SecurityKeyIdentifierClause clause = wrappingTokenParameters.CreateKeyIdentifierClause(wrappingToken, wrappingTokenReferenceStyle);
     SecurityKeyIdentifier wrappingTokenReference = new SecurityKeyIdentifier();
     wrappingTokenReference.Add(clause);
     return new WrappedKeySecurityToken(id, buffer, defaultAsymmetricKeyWrapAlgorithm, wrappingToken, wrappingTokenReference);
 }

 public void Add(SecurityToken token, SecurityTokenReferenceStyle allowedReferenceStyle, SecurityTokenParameters tokenParameters)
 {
     if (token == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("token");
     }
     if ((allowedReferenceStyle == SecurityTokenReferenceStyle.External) && (tokenParameters == null))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(System.ServiceModel.SR.GetString("ResolvingExternalTokensRequireSecurityTokenParameters"));
     }
     this.EnsureCapacityToAddToken();
     this.tokens[this.tokenCount++] = new SecurityTokenEntry(token, tokenParameters, allowedReferenceStyle);
 }

		public static void AssertSecurityTokenParameters (
			SecurityTokenInclusionMode protectionTokenInclusionMode,
			SecurityTokenReferenceStyle protectionTokenReferenceStyle,
			bool protectionTokenRequireDerivedKeys,
			SecurityTokenParameters tp, string label)
		{
			Assert.IsNotNull (tp, label + " IsNotNull");
			Assert.AreEqual (protectionTokenInclusionMode,
				tp.InclusionMode, label + ".InclusionMode");
			Assert.AreEqual (protectionTokenReferenceStyle,
				tp.ReferenceStyle, label + ".ReferenceStyle");
			Assert.AreEqual (protectionTokenRequireDerivedKeys,
				tp.RequireDerivedKeys, label + ".RequireDerivedKeys");
		}

        protected internal override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
        {
            SecurityKeyIdentifierClause clause = null;
            switch (this.x509ReferenceStyle)
            {
                case X509KeyIdentifierClauseType.Thumbprint:
                    return base.CreateKeyIdentifierClause<X509ThumbprintKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);

                case X509KeyIdentifierClauseType.IssuerSerial:
                    return base.CreateKeyIdentifierClause<X509IssuerSerialKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);

                case X509KeyIdentifierClauseType.SubjectKeyIdentifier:
                    return base.CreateKeyIdentifierClause<X509SubjectKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);

                case X509KeyIdentifierClauseType.RawDataKeyIdentifier:
                    return base.CreateKeyIdentifierClause<X509RawDataKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
            }
            if (referenceStyle == SecurityTokenReferenceStyle.External)
            {
                X509SecurityToken token2 = token as X509SecurityToken;
                if (token2 != null)
                {
                    X509SubjectKeyIdentifierClause clause2;
                    if (X509SubjectKeyIdentifierClause.TryCreateFrom(token2.Certificate, out clause2))
                    {
                        clause = clause2;
                    }
                }
                else
                {
                    X509SubjectKeyIdentifierClause clause3;
                    X509WindowsSecurityToken token3 = token as X509WindowsSecurityToken;
                    if ((token3 != null) && X509SubjectKeyIdentifierClause.TryCreateFrom(token3.Certificate, out clause3))
                    {
                        clause = clause3;
                    }
                }
                if (clause == null)
                {
                    clause = token.CreateKeyIdentifierClause<X509IssuerSerialKeyIdentifierClause>();
                }
                if (clause == null)
                {
                    clause = token.CreateKeyIdentifierClause<X509ThumbprintKeyIdentifierClause>();
                }
                return clause;
            }
            return token.CreateKeyIdentifierClause<LocalIdKeyIdentifierClause>();
        }

		protected virtual bool MatchesKeyIdentifierClause (
			SecurityToken token,
			SecurityKeyIdentifierClause keyIdentifierClause,
			SecurityTokenReferenceStyle referenceStyle)
		{
			throw new NotImplementedException ();
		}

		protected abstract SecurityKeyIdentifierClause CreateKeyIdentifierClause (
			SecurityToken token, SecurityTokenReferenceStyle referenceStyle);

 protected internal virtual new bool MatchesKeyIdentifierClause(System.IdentityModel.Tokens.SecurityToken token, System.IdentityModel.Tokens.SecurityKeyIdentifierClause keyIdentifierClause, SecurityTokenReferenceStyle referenceStyle)
 {
   return default(bool);
 }

 public virtual XmlElement CreateReferenceStyleAssertion(SecurityTokenReferenceStyle referenceStyle)
 {
     switch (referenceStyle)
     {
         default:
             throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentOutOfRangeException("referenceStyle"));
         case SecurityTokenReferenceStyle.External:
             return CreateWsspAssertion(RequireExternalReferenceName);
         case SecurityTokenReferenceStyle.Internal:
             return CreateWsspAssertion(RequireInternalReferenceName);
     }
 }

		protected override SecurityKeyIdentifierClause CreateKeyIdentifierClause (
			SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
		{
			RsaSecurityToken r = token as RsaSecurityToken;
			return r.CreateKeyIdentifierClause <RsaKeyIdentifierClause> ();
		}

 protected internal override SecurityKeyIdentifierClause CreateKeyIdentifierClause(SecurityToken token, SecurityTokenReferenceStyle referenceStyle)
 {
     return base.CreateKeyIdentifierClause<KerberosTicketHashKeyIdentifierClause, LocalIdKeyIdentifierClause>(token, referenceStyle);
 }