public override void ReadXml(XmlDictionaryReader reader, SamlSerializer samlSerializer, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
 {
     if (reader == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("reader"));
     }
     if (samlSerializer == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("samlSerializer"));
     }
     SamlDictionary samlDictionary = samlSerializer.DictionaryManager.SamlDictionary;
     if (!reader.IsStartElement(samlDictionary.DoNotCacheCondition, samlDictionary.Namespace))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(System.IdentityModel.SR.GetString("SAMLBadSchema", new object[] { samlDictionary.DoNotCacheCondition.Value })));
     }
     if (reader.IsEmptyElement)
     {
         reader.MoveToContent();
         reader.Read();
     }
     else
     {
         reader.MoveToContent();
         reader.Read();
         reader.ReadEndElement();
     }
 }

		public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator
			(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
		{
			// Return your implementation of the SecurityTokenProvider based on the 
			// tokenRequirement argument.
			SecurityTokenAuthenticator result;
			if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
			{
				MessageDirection direction = tokenRequirement.GetProperty<MessageDirection>
					(ServiceModelSecurityTokenRequirement.MessageDirectionProperty);
				if (direction == MessageDirection.Input)
				{
					outOfBandTokenResolver = null;
					result = new MySecurityTokenAuthenticator();
				}
				else
				{
					result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
				}
			}
			else
			{
				result = base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
			}

			return result;
		}

        /// <summary>
        /// Creates a security token authenticator based on the <see cref="T:System.IdentityModel.Selectors.SecurityTokenRequirement"/>.
        /// </summary>
        /// <param name="tokenRequirement">The <see cref="T:System.IdentityModel.Selectors.SecurityTokenRequirement"/>.</param>
        /// <param name="outOfBandTokenResolver">When this method returns, contains a <see cref="T:System.IdentityModel.Selectors.SecurityTokenResolver"/>. This parameter is passed uninitialized.</param>
        /// <returns>
        /// The <see cref="T:System.IdentityModel.Selectors.SecurityTokenAuthenticator"/>.
        /// </returns>
        /// <exception cref="T:System.ArgumentNullException">
        /// 	<paramref name="tokenRequirement"/> is null.</exception>
        /// <exception cref="T:System.NotSupportedException">A security token authenticator cannot be created for the<paramref name=" tokenRequirement"/> that was passed in.</exception>
        public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(
            SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
        {
            if (tokenRequirement.TokenType == SecurityTokenTypes.UserName)
            {
                outOfBandTokenResolver = null;

                // Get the current validator
                UserNamePasswordValidator validator = ServiceCredentials.UserNameAuthentication.CustomUserNamePasswordValidator;

                // Ensure that a validator exists
                if (validator == null)
                {
                    Trace.TraceWarning("Custom UserName Password Validator must be configued in web.config");

                    validator = new DefaultPersonnelValidator();
                }

                return new PersonnelUserNameTokenAuthenticator(validator);
            }

            // Return your implementation of the SecurityTokenAuthenticator, if required.
            // This implementation delegates to the base class.

            return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
        }

		public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator (
			SecurityTokenRequirement requirement,
			out SecurityTokenResolver outOfBandTokenResolver)
		{
			outOfBandTokenResolver = null;
			if (requirement.TokenType == SecurityTokenTypes.UserName)
				return CreateUserNameAuthenticator (requirement);
			if (requirement.TokenType == SecurityTokenTypes.X509Certificate)
				return CreateX509Authenticator (requirement);
			if (requirement.TokenType == SecurityTokenTypes.Rsa)
				return new RsaSecurityTokenAuthenticator ();
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.SecureConversation) {
				// FIXME: get parameters from somewhere
				SecurityContextSecurityTokenResolver resolver =
					new SecurityContextSecurityTokenResolver (0x1000, true);
				outOfBandTokenResolver = resolver;
				SecurityContextSecurityTokenAuthenticator sc =
					new SecurityContextSecurityTokenAuthenticator ();
				return new SecureConversationSecurityTokenAuthenticator (requirement, sc, resolver);
			}
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.AnonymousSslnego)
				return CreateSslTokenAuthenticator (requirement);
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.MutualSslnego)
				return CreateSslTokenAuthenticator (requirement);
			if (requirement.TokenType == ServiceModelSecurityTokenTypes.Spnego)
				return CreateSpnegoTokenAuthenticator (requirement);
			else
				throw new NotImplementedException ("Not implemented token type: " + requirement.TokenType);
		}

 public virtual SamlStatement LoadStatement(XmlDictionaryReader reader, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
 {
     if (reader == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");
     }
     if (reader.IsStartElement(this.DictionaryManager.SamlDictionary.AuthenticationStatement, this.DictionaryManager.SamlDictionary.Namespace))
     {
         SamlAuthenticationStatement statement = new SamlAuthenticationStatement();
         statement.ReadXml(reader, this, keyInfoSerializer, outOfBandTokenResolver);
         return statement;
     }
     if (reader.IsStartElement(this.DictionaryManager.SamlDictionary.AttributeStatement, this.DictionaryManager.SamlDictionary.Namespace))
     {
         SamlAttributeStatement statement2 = new SamlAttributeStatement();
         statement2.ReadXml(reader, this, keyInfoSerializer, outOfBandTokenResolver);
         return statement2;
     }
     if (!reader.IsStartElement(this.DictionaryManager.SamlDictionary.AuthorizationDecisionStatement, this.DictionaryManager.SamlDictionary.Namespace))
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new XmlException(System.IdentityModel.SR.GetString("SAMLUnableToLoadUnknownElement", new object[] { reader.LocalName })));
     }
     SamlAuthorizationDecisionStatement statement3 = new SamlAuthorizationDecisionStatement();
     statement3.ReadXml(reader, this, keyInfoSerializer, outOfBandTokenResolver);
     return statement3;
 }

        protected override SecurityToken ReadTokenCore(XmlReader reader, SecurityTokenResolver tokenResolver)
        {

            if (reader == null) throw new ArgumentNullException("reader");

            if (reader.IsStartElement(Constants.CreditCardTokenName, Constants.CreditCardTokenNamespace))
            {
                string id = reader.GetAttribute(Constants.Id, Constants.WsUtilityNamespace);

                reader.ReadStartElement();

                // read the credit card number
                string creditCardNumber = reader.ReadElementString(Constants.CreditCardNumberElementName, Constants.CreditCardTokenNamespace);

                // read the expiration date
                string expirationTimeString = reader.ReadElementString(Constants.CreditCardExpirationElementName, Constants.CreditCardTokenNamespace);
                DateTime expirationTime = XmlConvert.ToDateTime(expirationTimeString, XmlDateTimeSerializationMode.Utc);

                // read the issuer of the credit card
                string creditCardIssuer = reader.ReadElementString(Constants.CreditCardIssuerElementName, Constants.CreditCardTokenNamespace);
                reader.ReadEndElement();

                CreditCardInfo cardInfo = new CreditCardInfo(creditCardNumber, creditCardIssuer, expirationTime);

                return new CreditCardToken(cardInfo, id);
            }
            else
            {
                return WSSecurityTokenSerializer.DefaultInstance.ReadToken(reader, tokenResolver);
            }
        }

        public override void ReadXml(XmlDictionaryReader reader, SamlSerializer samlSerializer, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
        {
            if (reader == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("reader"));

            if (samlSerializer == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("samlSerializer"));

#pragma warning suppress 56506 // samlSerializer.DictionaryManager is never null.
            SamlDictionary dictionary = samlSerializer.DictionaryManager.SamlDictionary;

            if (!reader.IsStartElement(dictionary.DoNotCacheCondition, dictionary.Namespace))
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(SR.GetString(SR.SAMLBadSchema, dictionary.DoNotCacheCondition.Value)));

            // saml:DoNotCacheCondition is a empty element. So just issue a read for
            // the empty element.
            if (reader.IsEmptyElement)
            {
                reader.MoveToContent();
                reader.Read();
                return;
            }

            reader.MoveToContent();
            reader.Read();
            reader.ReadEndElement();
        }

        public virtual void ReadXml(XmlDictionaryReader reader, SamlSerializer samlSerializer, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
        {
            if (reader == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("reader"));

            if (samlSerializer == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("samlSerializer"));

#pragma warning suppress 56506 // samlSerializer.DictionaryManager is never null.
            SamlDictionary dictionary = samlSerializer.DictionaryManager.SamlDictionary;

            if (reader.IsStartElement(dictionary.Action, dictionary.Namespace))
            {
                // The Namespace attribute is optional.
                this.ns = reader.GetAttribute(dictionary.ActionNamespaceAttribute, null);

                reader.MoveToContent();
                this.action = reader.ReadString();
                if (string.IsNullOrEmpty(this.action))
                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(SR.GetString(SR.SAMLActionNameRequiredOnRead)));

                reader.MoveToContent();
                reader.ReadEndElement();
            }
        }

        protected override System.IdentityModel.Tokens.SecurityToken ReadTokenCore( XmlReader reader, SecurityTokenResolver tokenResolver )
        {
            if ( reader == null )
                throw new ArgumentNullException( "reader" );

            if ( reader.IsStartElement( Constants.UsernameTokenName, Constants.UsernameTokenNamespace ) )
            {
                //string id = reader.GetAttribute( Constants.IdAttributeName, Constants.WsUtilityNamespace );

                reader.ReadStartElement();

                // read the user name
                string userName = reader.ReadElementString( Constants.UsernameElementName, Constants.UsernameTokenNamespace );

                // read the password hash
                string password = reader.ReadElementString( Constants.PasswordElementName, Constants.UsernameTokenNamespace );

                // read nonce
                string nonce = reader.ReadElementString( Constants.NonceElementName, Constants.UsernameTokenNamespace );

                // read created
                string created = reader.ReadElementString( Constants.CreatedElementName, Constants.WsUtilityNamespace );

                reader.ReadEndElement();

                var info = new Info( userName, password );

                return new SecurityToken( info, nonce, created );
            }

            return DefaultInstance.ReadToken( reader, tokenResolver );
        }

 public SecurityToken ReadToken(XmlReader reader, SecurityTokenResolver tokenResolver)
 {
     if (reader == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");
     }
     return ReadTokenCore(reader, tokenResolver);
 }

        /// <summary>
        /// Constructor to use when working with SecurityKeyIdentifiers
        /// </summary>
        /// <param name="securityKeyIdentifier">SecurityKeyIdentifier that represents a SecuriytKey</param>
        /// <param name="securityTokenResolver">SecurityTokenResolver that can be resolved to a SecurityKey</param>
        /// <exception cref="ArgumentNullException">Thrown if the 'securityKeyIdentifier' is null</exception>
        public SecurityKeyElement(SecurityKeyIdentifier securityKeyIdentifier, SecurityTokenResolver securityTokenResolver)
        {
            if (securityKeyIdentifier == null)
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("securityKeyIdentifier");
            }

            Initialize(securityKeyIdentifier, securityTokenResolver);
        }

 public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
 {
     if (tokenRequirement.TokenType == CreditCardTokenConstants.CreditCardTokenType)
     {
         outOfBandTokenResolver = null;
         return new CreditCardTokenAuthenticator(creditCardServiceCredentials.ValidCreditCards);
     }
     return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
 }

 public virtual void ReadXml(XmlDictionaryReader reader, SamlSerializer samlSerializer, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
 {
     string str2;
     string str3;
     if (reader == null)
     {
         throw System.IdentityModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("reader"));
     }
     if (samlSerializer == null)
     {
         throw System.IdentityModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentNullException("samlSerializer"));
     }
     SamlDictionary samlDictionary = samlSerializer.DictionaryManager.SamlDictionary;
     string attribute = reader.GetAttribute(samlDictionary.AuthorityKind, null);
     if (string.IsNullOrEmpty(attribute))
     {
         throw System.IdentityModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(System.IdentityModel.SR.GetString("SAMLAuthorityBindingMissingAuthorityKindOnRead")));
     }
     string[] strArray = attribute.Split(new char[] { ':' });
     if (strArray.Length > 2)
     {
         throw System.IdentityModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(System.IdentityModel.SR.GetString("SAMLAuthorityBindingInvalidAuthorityKind")));
     }
     if (strArray.Length == 2)
     {
         str3 = strArray[0];
         str2 = strArray[1];
     }
     else
     {
         str3 = string.Empty;
         str2 = strArray[0];
     }
     string ns = reader.LookupNamespace(str3);
     this.authorityKind = new XmlQualifiedName(str2, ns);
     this.binding = reader.GetAttribute(samlDictionary.Binding, null);
     if (string.IsNullOrEmpty(this.binding))
     {
         throw System.IdentityModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(System.IdentityModel.SR.GetString("SAMLAuthorityBindingMissingBindingOnRead")));
     }
     this.location = reader.GetAttribute(samlDictionary.Location, null);
     if (string.IsNullOrEmpty(this.location))
     {
         throw System.IdentityModel.DiagnosticUtility.ExceptionUtility.ThrowHelperError(new SecurityTokenException(System.IdentityModel.SR.GetString("SAMLAuthorityBindingMissingLocationOnRead")));
     }
     if (reader.IsEmptyElement)
     {
         reader.MoveToContent();
         reader.Read();
     }
     else
     {
         reader.MoveToContent();
         reader.Read();
         reader.ReadEndElement();
     }
 }

        /// <summary>
        /// Creates an instance of IssuerTokenResolver using a given <see cref="SecurityTokenResolver"/>.
        /// </summary>
        /// <param name="wrappedTokenResolver">The <see cref="SecurityTokenResolver"/> to use.</param>
        public IssuerTokenResolver( SecurityTokenResolver wrappedTokenResolver )
        {
            if ( wrappedTokenResolver == null )
            {
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "wrappedTokenResolver" );
            }

            _wrappedTokenResolver = wrappedTokenResolver;
        }

 public virtual SamlAdvice LoadAdvice(XmlDictionaryReader reader, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
 {
     if (reader == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");
     }
     SamlAdvice advice = new SamlAdvice();
     advice.ReadXml(reader, this, keyInfoSerializer, outOfBandTokenResolver);
     return advice;
 }

 public virtual SamlConditions LoadConditions(XmlDictionaryReader reader, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
 {
     if (reader == null)
     {
         throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");
     }
     SamlConditions conditions = new SamlConditions();
     conditions.ReadXml(reader, this, keyInfoSerializer, outOfBandTokenResolver);
     return conditions;
 }

 protected override SecurityToken ReadTokenCore(XmlReader reader, SecurityTokenResolver tokenResolver)
 {
     var securityToken = serializer.ReadToken(reader, tokenResolver);
     if (securityToken is Saml2SecurityToken)
     {
         var saml2Token = (Saml2SecurityToken)securityToken;
         return new OIOSaml2SecurityToken(saml2Token.Assertion, saml2Token.SecurityKeys, saml2Token.IssuerToken);
     }
     return securityToken;
 }

        public virtual SamlAssertion LoadAssertion(XmlDictionaryReader reader, SecurityTokenSerializer keyInfoSerializer, SecurityTokenResolver outOfBandTokenResolver)
        {
            if (reader == null)
                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");

            SamlAssertion assertion = new SamlAssertion();
            assertion.ReadXml(reader, this, keyInfoSerializer, outOfBandTokenResolver);

            return assertion;
        }

        public override System.IdentityModel.Selectors.SecurityTokenAuthenticator CreateSecurityTokenAuthenticator( SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver )
        {
            if ( tokenRequirement.TokenType == Constants.UsernameTokenType )
            {
                outOfBandTokenResolver = null;
                return new SecurityTokenAuthenticator( _serviceCredentials.Validator );
            }

            return base.CreateSecurityTokenAuthenticator( tokenRequirement, out outOfBandTokenResolver );
        }

 public override SecurityTokenAuthenticator CreateSecurityTokenAuthenticator(SecurityTokenRequirement tokenRequirement, out SecurityTokenResolver outOfBandTokenResolver)
 {
     if (tokenRequirement.TokenType ==  SecurityTokenTypes.UserName)
     {
         outOfBandTokenResolver = null;
         return new MyTokenAuthenticator();
     }
     else
     {
         return base.CreateSecurityTokenAuthenticator(tokenRequirement, out outOfBandTokenResolver);
     }
 }