title: Error getting security token from adfs server
body: <p>To authenticate against ADFS and examine the claims i wish to get security token from the adfs server. However, the example code that i am working with always generates an error when requesting token. the example code is as follows:</p>
  
  <pre><code> private static SecurityToken RequestSamlToken()
              {
                  var factory = new WSTrustChannelFactory(
                      new UserNameWSTrustBinding(SecurityMode.TransportWithMessageCredential),
                      new EndpointAddress(adfsEndpoint));
                  factory.TrustVersion = TrustVersion.WSTrust13;
                  factory.Credentials.UserName.UserName = username;
                  factory.Credentials.UserName.Password = password;
  
                  var rst = new RequestSecurityToken
                  {
                      RequestType = RequestTypes.Issue,
                      KeyType = KeyTypes.Bearer,  
                      AppliesTo = new EndpointReference(realm)
                  };
  
                  return factory.CreateChannel().Issue(rst);
              }
  </code></pre>
  
  <p>I am getting the following error:</p>
  
  <p><strong>An unhandled exception of type 'System.ServiceModel.FaultException' occurred in System.ServiceModel.dll
  Additional information: ID3082: The request scope is not valid or is unsupported</strong>.</p>
  
  <p>Is there any configuration missing in the ADFS server that disallows serving tokens? Another snippet of code that uses IdpInitiated Logon works to generate the SAML token.
  THE ADFS properties are as follows-</p>
  
  <pre><code>AcceptableIdentifiers                      : {}
  AddProxyAuthorizationRules                 : exists([Type ==
                                               "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid", Value
                                               == "S-1-5-32-544", Issuer =~ "^AD AUTHORITY$"]) =&gt; issue(Type =
                                               "http://schemas.microsoft.com/authorization/claims/permit", Value =
                                               "true");
                                                           c:[Type ==
                                               "http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid",
                                               Issuer =~ "^AD AUTHORITY$" ]
                                                                      =&gt; issue(store="_ProxyCredentialStore",types=("http
                                               ://schemas.microsoft.com/authorization/claims/permit"),query="isProxyTrust
                                               ManagerSid({0})", param=c.Value );
                                                           c:[Type ==
                                               "http://schemas.microsoft.com/ws/2008/06/identity/claims/proxytrustid",
                                               Issuer =~ "^SELF AUTHORITY$" ]
                                                                      =&gt; issue(store="_ProxyCredentialStore",types=("http
                                               ://schemas.microsoft.com/authorization/claims/permit"),query="isProxyTrust
                                               Provisioned({0})", param=c.Value );
  ArtifactDbConnection                       : Data Source=np:\\.\pipe\microsoft##wid\tsql\query;Initial
                                               Catalog=AdfsArtifactStore;Integrated Security=True
  AuthenticationContextOrder                 : {urn:oasis:names:tc:SAML:2.0:ac:classes:Password,
                                               urn:oasis:names:tc:SAML:2.0:ac:classes:PasswordProtectedTransport,
                                               urn:oasis:names:tc:SAML:2.0:ac:classes:TLSClient,
                                               urn:oasis:names:tc:SAML:2.0:ac:classes:X509...}
  AutoCertificateRollover                    : True
  CertificateCriticalThreshold               : 2
  CertificateDuration                        : 365
  CertificateGenerationThreshold             : 20
  CertificatePromotionThreshold              : 5
  CertificateRolloverInterval                : 720
  CertificateSharingContainer                : CN=6b987b00-35ce-44d9-97c8-561b6f1ac3dd,CN=ADFS,CN=Microsoft,CN=Program
                                               Data,DC=sciemetricdev,DC=com
  CertificateThresholdMultiplier             : 1440
  ClientCertRevocationCheck                  : None
  ContactPerson                              :
  DisplayName                                : ADFS
  IntranetUseLocalClaimsProvider             : False
  ExtendedProtectionTokenCheck               : Allow
  FederationPassiveAddress                   : /adfs/ls/
  HostName                                   : *************.com
  HttpPort                                   : 80
  HttpsPort                                  : 443
  TlsClientPort                              : 49443
  Identifier                                 : http://*******.com/adfs/services/trust
  InstalledLanguage                          : en-US
  LogLevel                                   : {Errors, Information, Verbose, Warnings}
  MonitoringInterval                         : 1440
  NetTcpPort                                 : 1501
  NtlmOnlySupportedClientAtProxy             : False
  OrganizationInfo                           :
  PreventTokenReplays                        : False
  ProxyTrustTokenLifetime                    : 21600
  ReplayCacheExpirationInterval              : 60
  SignedSamlRequestsRequired                 : False
  SamlMessageDeliveryWindow                  : 5
  SignSamlAuthnRequests                      : False
  SsoLifetime                                : 480
  PersistentSsoLifetimeMins                  : 10080
  KmsiLifetimeMins                           : 1440
  PersistentSsoEnabled                       : True
  PersistentSsoCutoffTime                    : 1/1/0001 12:00:00 AM
  KmsiEnabled                                : False
  LoopDetectionEnabled                       : True
  LoopDetectionTimeIntervalInSeconds         : 20
  LoopDetectionMaximumTokensIssuedInInterval : 5
  PasswordValidationDelayInMinutes           : 60
  SendClientRequestIdAsQueryStringParameter  : False
  WIASupportedUserAgents                     : {MSAuthHost/1.0/In-Domain, MSIE 6.0, MSIE 7.0, MSIE 8.0...}
  ExtranetLockoutThreshold                   : 2147483647
  ExtranetLockoutEnabled                     : False
  ExtranetObservationWindow                  : 00:30:00
  </code></pre>