Active RP RST Request always has null claims collection

Question

I have a RP (WCF service) which is configured for federated access to my STS.
The configuration of the RP specifies the claim types I'd like returned in my RSTR.

When the RST arrives at the STS however, the claims collection is always null.  Where do I look to find the list of requested claim types?

perhaps I have misconfigured my client.  Here's what I have (generated by FedUtil)

    <binding name="WS2007FederationHttpBinding_IShoppingCartService">

                    <security defaultAlgorithmSuite="Default" authenticationMode="SecureConversation"

                        requireDerivedKeys="true" securityHeaderLayout="Strict" includeTimestamp="true"

                        keyEntropyMode="CombinedEntropy" messageProtectionOrder="SignBeforeEncryptAndEncryptSignature"

                        messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"

                        requireSecurityContextCancellation="true" requireSignatureConfirmation="false">

                        <localClientSettings ... />

                        <secureConversationBootstrap defaultAlgorithmSuite="Default"

                            authenticationMode="IssuedTokenForSslNegotiated" requireDerivedKeys="true"

                            securityHeaderLayout="Strict" includeTimestamp="true" keyEntropyMode="CombinedEntropy"

                            messageProtectionOrder="SignBeforeEncryptAndEncryptSignature"

                            messageSecurityVersion="WSSecurity11WSTrust13WSSecureConversation13WSSecurityPolicy12BasicSecurityProfile10"

                            requireSecurityContextCancellation="true" requireSignatureConfirmation="true">

                            <issuedTokenParameters keySize="256" keyType="SymmetricKey" tokenType="">

                                <additionalRequestParameters>

                                    <trust:SecondaryParameters xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">

                                        <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType>

                                        <trust:KeySize xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">256</trust:KeySize>

                                        <trust:Claims Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity"

                                            xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">

                                            <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name"

                                                Optional="true" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />

                                            <wsid:ClaimType Uri="http://schemas.microsoft.com/ws/2008/06/identity/claims/role"

                                                Optional="true" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />

                                            <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/givenname"

                                                Optional="true" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />

                                            <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/surname"

                                                Optional="true" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />

                                            <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"

                                                Optional="true" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />

                                            <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/dateofbirth"

                                                xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity" />

 
                                        </trust:Claims>

I understand why the claims collection would be null under passive federation, but I thought this was supported for Active.

Answer 1

Did you look inside the Secondary parameters?

Answer 2

Yep.. Thats where they were hiding.

Thanks.