I'm trying to implement an SSO for microsoft dynamics 2011 as described in this (very poorly written) [walkthrough](http://msdn.microsoft.com/en-us/library/gg509057.aspx).  

I've configured my ASP.NET website as a relying party in ADFS manager, and followed the instructions to add an STS reference.  

I've defined an issuance transform rule for the UPN field in ADFS. 

In my ASP.NET application, when doing this-  

`IClaimsIdentity claimsIdentity = ((IClaimsPrincipal)(Thread.CurrentPrincipal)).Identities[0];` I do get an instance of `Microsoft.IdentityModel.Claims.ClaimsIdentity`, however, its `Claims` collection is empty. 

I've noticed, however, that the `FederationMetadata.xml` generated by the 'add sts' wizard only contains 2 `<auth:ClaimType>` elements- for `name` and `role`, both optional=true.  

However, if I try to manually edit and update my relying party's `FederationMetadata.xml` to add `upn` as a claim type, or to make one of the existing claim types non-optional, I encounter the following error- `ID6018 Digest verification failed...`.  

If I revert back to 'optional=true' for both, the error doesn't occur.

Can anyone provide any insight as to how to get the `UPN` field to my ASP.NET app?  

Also, better how-to's / walkthroughs than the one I've mentioned would be greatly appreciated.

I'm not really sure what further information to supply here, so i'll just post my application's `FederationMetadata.xml`: 

```
<?xml version="1.0" encoding="utf-8"?>

<EntityDescriptor ID="_bad84517-5281-47e8-be9d-2e1a78eae772" entityID="https://MyAspnetSite.com:4455/"
                  xmlns="urn:oasis:names:tc:SAML:2.0:metadata">
  <ds:Signature xmlns:ds="http://www.w3.org/2000/09/xmldsig#">
    <ds:SignedInfo>
      <ds:CanonicalizationMethod Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
      <ds:SignatureMethod Algorithm="http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" />
      <ds:Reference URI="#_bad84517-5281-47e8-be9d-2e1a78eae772">
        <ds:Transforms>
          <ds:Transform Algorithm="http://www.w3.org/2000/09/xmldsig#enveloped-signature" />
          <ds:Transform Algorithm="http://www.w3.org/2001/10/xml-exc-c14n#" />
        </ds:Transforms>
        <ds:DigestMethod Algorithm="http://www.w3.org/2001/04/xmlenc#sha256" />
        <ds:DigestValue>
          eWoZYLA/oMNMWd+S9m0TlbIg2rUSuumAckA0BTdAqbg=
        </ds:DigestValue>
      </ds:Reference>
    </ds:SignedInfo>
    <ds:SignatureValue>
      yMubsY42ZblFDP4ZFEO06uT317c/xdMUF7PrOhPpShkDtbigg1TWq3tGYEa35+xpfjqQCseHJH07ftkxOH6t0u6ngqbGCmZ4yaOBTA3bdbGMGull6WwLSQIxNn2eR1mRzyF2mIM3t4Jfl6EoOZ0msnsyUTVI9Oq03eFweDN2zoI=
    </ds:SignatureValue>
    <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
      <X509Data>
        <X509Certificate>
           certificate data
        </X509Certificate>
      </X509Data>
    </KeyInfo>
  </ds:Signature>
  <RoleDescriptor xsi:type="fed:ApplicationServiceType"
                  protocolSupportEnumeration="http://schemas.xmlsoap.org/ws/2005/02/trust http://docs.oasis-open.org/ws-sx/ws-trust/200512"
                  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:fed="http://docs.oasis-open.org/wsfed/federation/200706">
    <KeyDescriptor use="encryption">
      <KeyInfo xmlns="http://www.w3.org/2000/09/xmldsig#">
        <X509Data>
          <X509Certificate>

           certificate data
          </X509Certificate>
        </X509Data>
      </KeyInfo>
    </KeyDescriptor>
    <fed:ClaimTypesRequested>
      <auth:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Optional="false"
                      xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" />
      <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Optional="false"
                      xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" />
      <auth:ClaimType Uri="http://schemas.microsoft.com/ws/2005/05/identity/claims/upn" Optional="false"
                      xmlns:auth="http://docs.oasis-open.org/wsfed/authorization/200706" />
    </fed:ClaimTypesRequested>
    <fed:TargetScopes>
      <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
        <Address>
          https://MyAspnetSite.com:4455/
        </Address>
      </EndpointReference>
    </fed:TargetScopes>
    <fed:ApplicationServiceEndpoint>
      <EndpointReference xmlns="http://www.w3.org/2005/08/addressing">
        <Address>
          https://MyAspnetSite.com:4455/
        </Address>
      </EndpointReference>
    </fed:ApplicationServiceEndpoint>
  </RoleDescriptor>
</EntityDescriptor>

```