protected override SecurityKeyIdentifier ReadKeyIdentifierCore(XmlReader reader)
        {
            var result = new SecurityKeyIdentifier();

            reader.ReadStartElement("KeyInfo", SignedXml.XmlDsigNamespaceUrl);

            while (reader.IsStartElement())
            {
                if (reader.IsStartElement("X509Data", SignedXml.XmlDsigNamespaceUrl))
                {
                    foreach (var clause in ReadX509Data(reader))
                    {
                        result.Add(clause);
                    }
                }
                else
                {
                    if (reader.IsStartElement("KeyName", SignedXml.XmlDsigNamespaceUrl))
                    {
                        result.Add(ReadKeyNameClause(reader));
                    }
                    else
                    {
                        reader.Skip();
                    }
                }
            }

            reader.ReadEndElement();

            return result;
        }

 public SamlSubject(string nameFormat, string nameQualifier, string name, IEnumerable<string> confirmations, string confirmationData, SecurityKeyIdentifier securityKeyIdentifier)
 {
     this.confirmationMethods = new ImmutableCollection<string>();
     if (confirmations != null)
     {
         foreach (string str in confirmations)
         {
             if (string.IsNullOrEmpty(str))
             {
                 throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(System.IdentityModel.SR.GetString("SAMLEntityCannotBeNullOrEmpty", new object[] { XD.SamlDictionary.SubjectConfirmationMethod.Value }));
             }
             this.confirmationMethods.Add(str);
         }
     }
     if ((this.confirmationMethods.Count == 0) && string.IsNullOrEmpty(name))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(System.IdentityModel.SR.GetString("SAMLSubjectRequiresNameIdentifierOrConfirmationMethod"));
     }
     if ((this.confirmationMethods.Count == 0) && ((confirmationData != null) || (securityKeyIdentifier != null)))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(System.IdentityModel.SR.GetString("SAMLSubjectRequiresConfirmationMethodWhenConfirmationDataOrKeyInfoIsSpecified"));
     }
     this.name = name;
     this.nameFormat = nameFormat;
     this.nameQualifier = nameQualifier;
     this.confirmationData = confirmationData;
     this.securityKeyIdentifier = securityKeyIdentifier;
 }

        public SamlSubject(string nameFormat, string nameQualifier, string name, IEnumerable<string> confirmations, string confirmationData, SecurityKeyIdentifier securityKeyIdentifier)
        {
            if (confirmations != null)
            {
                foreach (string method in confirmations)
                {
                    if (string.IsNullOrEmpty(method))
                        throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(SR.GetString(SR.SAMLEntityCannotBeNullOrEmpty, XD.SamlDictionary.SubjectConfirmationMethod.Value));

                    this.confirmationMethods.Add(method);
                }
            }

            if ((this.confirmationMethods.Count == 0) && (string.IsNullOrEmpty(name)))
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(SR.GetString(SR.SAMLSubjectRequiresNameIdentifierOrConfirmationMethod));

            if ((this.confirmationMethods.Count == 0) && ((confirmationData != null) || (securityKeyIdentifier != null)))
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument(SR.GetString(SR.SAMLSubjectRequiresConfirmationMethodWhenConfirmationDataOrKeyInfoIsSpecified));

            this.name = name;
            this.nameFormat = nameFormat;
            this.nameQualifier = nameQualifier;
            this.confirmationData = confirmationData;
            this.securityKeyIdentifier = securityKeyIdentifier;
        }

 protected override bool TryResolveTokenCore(SecurityKeyIdentifier keyIdentifier, out SecurityToken token)
 {
     bool flag = false;
     token = null;
     flag = this.tokenResolver.TryResolveToken(keyIdentifier, false, false, out token);
     if (!flag && (this.outOfBandTokenResolvers != null))
     {
         for (int i = 0; i < this.outOfBandTokenResolvers.Count; i++)
         {
             flag = this.outOfBandTokenResolvers[i].TryResolveToken(keyIdentifier, out token);
             if (flag)
             {
                 break;
             }
         }
     }
     if (!flag)
     {
         for (int j = 0; j < keyIdentifier.Count; j++)
         {
             if (this.TryResolveTokenFromIntrinsicKeyClause(keyIdentifier[j], out token))
             {
                 return true;
             }
         }
     }
     return flag;
 }

        /// <summary>
        /// Constructs an EncryptingCredentials with a security key, a security key identifier and
        /// the encryption algorithm.
        /// </summary>
        /// <param name="key">A security key for encryption.</param>
        /// <param name="keyIdentifier">A security key identifier for the encryption key.</param>
        /// <param name="algorithm">The encryption algorithm.</param>
        /// <exception cref="ArgumentNullException">When key is null.</exception>
        /// <exception cref="ArgumentNullException">When key identifier is null.</exception>
        /// <exception cref="ArgumentNullException">When algorithm is null.</exception>
        public EncryptingCredentials(SecurityKey key, SecurityKeyIdentifier keyIdentifier, string algorithm)
        {
            if (key == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("key");
            }

            if (keyIdentifier == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifier");
            }

            if (string.IsNullOrEmpty(algorithm))
            {
                throw DiagnosticUtility.ThrowHelperArgumentNullOrEmptyString("algorithm");
            }

            //
            // It is possible that keyIdentifier is pointing to a token which 
            // is not capable of doing the given algorithm, we have no way verify 
            // that at this level.
            //
            _algorithm = algorithm;
            _key = key;
            _keyIdentifier = keyIdentifier;
        }

		public SigningCredentials (SecurityKey signingKey, string signatureAlgorithm, string digestAlgorithm, SecurityKeyIdentifier signingKeyIdentifier)
			: this (signingKey, signatureAlgorithm, digestAlgorithm)
		{
			if (signingKeyIdentifier == null)
				throw new ArgumentNullException ("signingKeyIdentifier");
			this.identifier = signingKeyIdentifier;
		}

 public bool CanWriteKeyIdentifier(SecurityKeyIdentifier keyIdentifier)
 {
     if (keyIdentifier == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifier");
     }
     return this.CanWriteKeyIdentifierCore(keyIdentifier);
 }

 public bool TryResolveToken(SecurityKeyIdentifier keyIdentifier, out SecurityToken token)
 {
     if (keyIdentifier == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifier");
     }
     return TryResolveTokenCore(keyIdentifier, out token);
 }

 protected override SecurityKey ResolveIssuerSigningKey(string token, SecurityToken securityToken, SecurityKeyIdentifier keyIdentifier, TokenValidationParameters validationParameters)
 {
     var certificate = ((JwtSecurityToken)securityToken).GetCertificateFromToken();
     if (certificate != null)
     {
         keyIdentifier.Add(new X509RawDataKeyIdentifierClause(certificate));
     }
     return base.ResolveIssuerSigningKey(token, securityToken, keyIdentifier, validationParameters);
 }

        /// <summary>
        /// Creates a SAML Token with the input parameters
        /// </summary>
        /// <param name="stsName">Name of the STS issuing the SAML Token</param>
        /// <param name="proofToken">Associated Proof Token</param>
        /// <param name="issuerToken">Associated Issuer Token</param>
        /// <param name="proofKeyEncryptionToken">Token to encrypt the proof key with</param>
        /// <param name="samlConditions">The Saml Conditions to be used in the construction of the SAML Token</param>
        /// <param name="samlAttributes">The Saml Attributes to be used in the construction of the SAML Token</param>
        /// <returns>A SAML Token</returns>
        public static SamlSecurityToken CreateSamlToken(string stsName,
                                                        BinarySecretSecurityToken proofToken,
                                                        SecurityToken issuerToken,
                                                        SecurityToken proofKeyEncryptionToken,
                                                        SamlConditions samlConditions,
                                                        IEnumerable<SamlAttribute> samlAttributes)
		{
            // Create a security token reference to the issuer certificate 
            SecurityKeyIdentifierClause skic = issuerToken.CreateKeyIdentifierClause<X509ThumbprintKeyIdentifierClause>();
            SecurityKeyIdentifier issuerKeyIdentifier = new SecurityKeyIdentifier(skic);

            // Create an encrypted key clause containing the encrypted proof key
            byte[] wrappedKey = proofKeyEncryptionToken.SecurityKeys[0].EncryptKey(SecurityAlgorithms.RsaOaepKeyWrap, proofToken.GetKeyBytes());
            SecurityKeyIdentifierClause encryptingTokenClause = proofKeyEncryptionToken.CreateKeyIdentifierClause<X509ThumbprintKeyIdentifierClause>();
            EncryptedKeyIdentifierClause encryptedKeyClause = new EncryptedKeyIdentifierClause(wrappedKey, SecurityAlgorithms.RsaOaepKeyWrap, new SecurityKeyIdentifier(encryptingTokenClause) );
            SecurityKeyIdentifier proofKeyIdentifier = new SecurityKeyIdentifier(encryptedKeyClause);

            // Create a comfirmationMethod for HolderOfKey
			List<string> confirmationMethods = new List<string>(1);
			confirmationMethods.Add(SamlConstants.HolderOfKey);

            // Create a SamlSubject with proof key and confirmation method from above
			SamlSubject samlSubject = new SamlSubject(null,
													  null,
													  null,
													  confirmationMethods,
													  null,
                                                      proofKeyIdentifier);

            // Create a SamlAttributeStatement from the passed in SamlAttribute collection and the SamlSubject from above
			SamlAttributeStatement samlAttributeStatement = new SamlAttributeStatement(samlSubject, samlAttributes);

            // Put the SamlAttributeStatement into a list of SamlStatements
			List<SamlStatement> samlSubjectStatements = new List<SamlStatement>();
			samlSubjectStatements.Add(samlAttributeStatement);

            // Create a SigningCredentials instance from the key associated with the issuerToken.
            SigningCredentials signingCredentials = new SigningCredentials(issuerToken.SecurityKeys[0],
                                                                           SecurityAlgorithms.RsaSha1Signature,
                                                                           SecurityAlgorithms.Sha1Digest,
                                                                           issuerKeyIdentifier);

            // Create a SamlAssertion from the list of SamlStatements created above and the passed in
            // SamlConditions.
			SamlAssertion samlAssertion = new SamlAssertion("_" + Guid.NewGuid().ToString(),
							                                stsName,
							                                DateTime.UtcNow,
							                                samlConditions,
							                                new SamlAdvice(),
							                                samlSubjectStatements
						                                	);
            // Set the SigningCredentials for the SamlAssertion
			samlAssertion.SigningCredentials = signingCredentials;

            // Create a SamlSecurityToken from the SamlAssertion and return it
			return new SamlSecurityToken(samlAssertion);
		}

        /// <summary>
        /// Constructor to use when working with SecurityKeyIdentifiers
        /// </summary>
        /// <param name="securityKeyIdentifier">SecurityKeyIdentifier that represents a SecuriytKey</param>
        /// <param name="securityTokenResolver">SecurityTokenResolver that can be resolved to a SecurityKey</param>
        /// <exception cref="ArgumentNullException">Thrown if the 'securityKeyIdentifier' is null</exception>
        public SecurityKeyElement(SecurityKeyIdentifier securityKeyIdentifier, SecurityTokenResolver securityTokenResolver)
        {
            if (securityKeyIdentifier == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("securityKeyIdentifier");
            }

            Initialize(securityKeyIdentifier, securityTokenResolver);
        }

        /// <summary>
        /// Constructs a proof token based on RSA key.
        /// </summary>
        /// <param name="rsaAlgorithm"></param>
        public AsymmetricProofDescriptor( RSA rsaAlgorithm )
        {
            if ( rsaAlgorithm == null )
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "rsaAlgorithm" );
            }

            _keyIdentifier = new SecurityKeyIdentifier(new RsaKeyIdentifierClause(rsaAlgorithm));
        }

		public EncryptedKeyIdentifierClause (
			byte [] encryptedKey, string encryptionMethod,
			SecurityKeyIdentifier identifier, string carriedKeyName,
			byte [] derivationNonce, int derivationLength)
			: base (encryptionMethod, encryptedKey, true, derivationNonce, derivationLength)
		{
			this.carried_key_name = carriedKeyName;
			this.identifier = identifier;
			this.enc_method = encryptionMethod;
		}

		public SecurityToken ResolveToken (
			SecurityKeyIdentifier keyIdentifier)
		{
			if (keyIdentifier == null)
				throw new ArgumentNullException ("keyIdentifierClause");
			SecurityToken ret;
			if (!TryResolveToken (keyIdentifier, out ret))
				throw new InvalidOperationException (String.Format ("Could not resolve security token from the key identifier '{0}'", keyIdentifier));
			return ret;
		}

 internal EncryptedKeyIdentifierClause(byte[] encryptedKey, string encryptionMethod, SecurityKeyIdentifier encryptingKeyIdentifier, string carriedKeyName, bool cloneBuffer, byte[] derivationNonce, int derivationLength) : base("http://www.w3.org/2001/04/xmlenc#EncryptedKey", encryptedKey, cloneBuffer, derivationNonce, derivationLength)
 {
     if (encryptionMethod == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("encryptionMethod");
     }
     this.carriedKeyName = carriedKeyName;
     this.encryptionMethod = encryptionMethod;
     this.encryptingKeyIdentifier = encryptingKeyIdentifier;
 }

		protected override bool TryResolveTokenCore (
			SecurityKeyIdentifier keyIdentifier,
			out SecurityToken token)
		{
			token = null;
			foreach (SecurityTokenResolver r in resolvers)
				if (r != null && r.TryResolveToken (keyIdentifier, out token))
					return true;
			return false;
		}

        public AzureKeyVaultSigningCredentials(RsaSecurityKey signingKey, string digestAlgorithm, SecurityKeyIdentifier signingKeyIdentifier = null) : base(signingKey, SecurityAlgorithms.RsaSha256Signature, digestAlgorithm, signingKeyIdentifier)
        {
            if (signingKey.HasPrivateKey())
            {
                throw new ArgumentException("For security reasons, the signing key cannot contain the private key. Please remove all traces of this from the application and defer to Azure Key Vault for signing.", nameof(signingKey));
            }

            if (digestAlgorithm != SecurityAlgorithms.Sha256Digest && digestAlgorithm != SecurityAlgorithms.Sha512Digest)
            {
                throw new ArgumentOutOfRangeException(nameof(digestAlgorithm), digestAlgorithm, "Only SHA256 and SHA512 are supported at this time.");
            }
        }

		public SamlSubject (string nameFormat, string nameQualifier, string name, IEnumerable<string> confirmations, string confirmationData, SecurityKeyIdentifier securityKeyIdentifier)
		{
			if (name == null || name.Length == 0)
				throw new ArgumentException ("non-zero length string must be specified for name of SAML Subject.");
			name_format = nameFormat;
			name_qualifier = nameQualifier;
			this.name = name;

			confirmation_methods = new List<string> (confirmations);
			confirmation_data = confirmationData;
			key_identifier = securityKeyIdentifier;
		}

 SecurityKey SigningKeyResolver(string token, SecurityToken securityToken, SecurityKeyIdentifier keyIdentifier, TokenValidationParameters validationParameters)
 {
     foreach (var keyIdentifierClause in keyIdentifier)
     {
         var match = Issuers
             .SelectMany(issuer => issuer.GetConfigurationAsync(CancellationToken.None).Result.SigningTokens)
             .FirstOrDefault(t => t.MatchesKeyIdentifierClause(keyIdentifierClause));
         if (match != null)
             return match.SecurityKeys[0];
     }
     return null;
 }

 public SecurityToken ResolveToken(SecurityKeyIdentifier keyIdentifier)
 {
     if (keyIdentifier == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("keyIdentifier");
     }
     SecurityToken token;
     if (!this.TryResolveTokenCore(keyIdentifier, out token))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperWarning(new InvalidOperationException(SR.GetString(SR.UnableToResolveTokenReference, keyIdentifier)));
     }
     return token;
 }