Imported Upstream version 4.6.0.125

Former-commit-id: a2155e9bd80020e49e72e86c44da02a8ac0e57a4

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/AdditionalContext.cs

@@ -0,0 +1,51 @@
+//-----------------------------------------------------------------------
+// <copyright file="AdditionalContext.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.Collections.Generic;
+
+    /// <summary>
+    /// Defines the auth:AdditionalContext element.
+    /// </summary>
+    public class AdditionalContext
+    {
+        List<ContextItem> _contextItems = new List<ContextItem>();
+
+        /// <summary>
+        /// Initializes an instance of <see cref="AdditionalContext"/>
+        /// </summary>
+        public AdditionalContext()
+        {
+        }
+
+        /// <summary>
+        /// Initializes an instance of <see cref="AdditionalContext"/>
+        /// </summary>
+        /// <param name="items">Collection of ContextItems</param>
+        /// <exception cref="ArgumentNullException">Input argument 'items' is null.</exception>
+        public AdditionalContext( IEnumerable<ContextItem> items )
+        {
+            if ( items == null )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "items" );
+            }
+
+            foreach ( ContextItem item in items )
+            {
+                _contextItems.Add( item );
+            }
+        }
+
+        /// <summary>
+        /// Gets the Collection of items.
+        /// </summary>
+        public IList<ContextItem> Items
+        {
+            get { return _contextItems; }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/BinaryExchange.cs

@@ -0,0 +1,92 @@
+//-----------------------------------------------------------------------
+// <copyright file="BinaryExchange.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// Represents the contents of the BinaryExchange element.  
+    /// </summary>
+    public class BinaryExchange
+    {
+        byte[] _binaryData;
+        Uri _valueType;
+        Uri _encodingType;
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinaryExchange"/>
+        /// </summary>
+        /// <param name="binaryData">Binary data exchanged.</param>
+        /// <param name="valueType">Uri representing the value type of the binary data.</param>
+        /// <exception cref="ArgumentNullException">Input parameter 'binaryData' or 'valueType' is null.</exception>
+        public BinaryExchange( byte[] binaryData, Uri valueType )
+            : this( binaryData, valueType, new Uri( WSSecurity10Constants.EncodingTypes.Base64 ) )
+        {
+        }
+
+        /// <summary>
+        /// Creates an instance of <see cref="BinaryExchange"/>
+        /// </summary>
+        /// <param name="binaryData">Binary data exchanged.</param>
+        /// <param name="valueType">Uri representing the value type of the binary data.</param>
+        /// <param name="encodingType">Encoding type to be used for encoding teh </param>
+        /// <exception cref="ArgumentNullException">Input parameter 'binaryData', 'valueType' or 'encodingType' is null.</exception>
+        public BinaryExchange( byte[] binaryData, Uri valueType, Uri encodingType )
+        {
+            if ( binaryData == null )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "binaryData" );
+            }
+
+            if ( valueType == null )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "valueType" );
+            }
+
+            if ( encodingType == null )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "encodingType" );
+            }
+
+            if ( !valueType.IsAbsoluteUri )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument( "valueType", SR.GetString( SR.ID0013 ) );
+            }
+
+            if ( !encodingType.IsAbsoluteUri )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument( "encodingType", SR.GetString( SR.ID0013 ) );
+            }
+
+            _binaryData = binaryData;
+            _valueType = valueType;
+            _encodingType = encodingType;
+        }
+
+        /// <summary>
+        /// Gets the Binary Data.
+        /// </summary>
+        public byte[] BinaryData
+        {
+            get { return _binaryData; }
+        }
+
+        /// <summary>
+        /// Gets the ValueType Uri.
+        /// </summary>
+        public Uri ValueType
+        {
+            get { return _valueType; }
+        }
+
+        /// <summary>
+        /// Gets the EncodingType Uri.
+        /// </summary>
+        public Uri EncodingType
+        {
+            get { return _encodingType; }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/ContextItem.cs

@@ -0,0 +1,101 @@
+//-----------------------------------------------------------------------
+// <copyright file="ContextItem.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// Defines the auth:ContextItem element.
+    /// </summary>
+    public class ContextItem
+    {
+        Uri _name;
+        Uri _scope;
+        string _value;
+
+        /// <summary>
+        /// Initializes an instance of <see cref="ContextItem"/>
+        /// </summary>
+        /// <param name="name">Context item name.</param>
+        public ContextItem(Uri name)
+            : this(name, null)
+        {
+        }
+
+        /// <summary>
+        /// Initializes an instance of <see cref="ContextItem"/>
+        /// </summary>
+        /// <param name="name">Context item name.</param>
+        /// <param name="value">Context item value. Can be null.</param>
+        public ContextItem(Uri name, string value)
+            : this(name, value, null)
+        {
+        }
+
+        /// <summary>
+        /// Initializes an instance of <see cref="ContextItem"/>
+        /// </summary>
+        /// <param name="name">Context item name.</param>
+        /// <param name="value">Context item value. Can be null.</param>
+        /// <param name="scope">Context item scope. Can be null.</param>
+        /// <exception cref="ArgumentNullException">Input argument 'name' is null.</exception>
+        /// <exception cref="ArgumentException">Input argument 'name' or 'scope' is not an absolute URI.</exception>
+        public ContextItem(Uri name, string value, Uri scope)
+        {
+            if (name == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("name");
+            }
+
+            if (!name.IsAbsoluteUri)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument("name", SR.GetString(SR.ID0013));
+            }
+
+            if ((scope != null) && !scope.IsAbsoluteUri)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument("scope", SR.GetString(SR.ID0013));
+            }
+
+            _name = name;
+            _scope = scope;
+            _value = value;
+        }
+
+        /// <summary>
+        /// Gets the name of the item.
+        /// </summary>
+        public Uri Name
+        {
+            get { return _name; }
+            set { _name = value; }
+        }
+
+        /// <summary>
+        /// Gets the Scope of the item.
+        /// </summary>
+        public Uri Scope
+        {
+            get { return _scope; }
+            set
+            {
+                if ((value != null) && !value.IsAbsoluteUri)
+                {
+                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument("value", SR.GetString(SR.ID0013));
+                }
+                _scope = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets the value of the item.
+        /// </summary>
+        public string Value
+        {
+            get { return _value; }
+            set { _value = value; }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/EndpointReference.cs

@@ -0,0 +1,126 @@
+//-----------------------------------------------------------------------
+// <copyright file="EndpointReference.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.Collections.ObjectModel;
+    using System.Xml;
+
+    public class EndpointReference
+    {
+        Collection<XmlElement> _details = new Collection<XmlElement>();
+
+        Uri uri;
+
+        public Collection<XmlElement> Details
+        {
+            get
+            {
+                return _details;
+            }
+        }
+        
+        public EndpointReference(string uri)
+        {
+            if (uri == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("uri");
+            }
+
+            Uri tempUri = new Uri(uri);
+
+            if (!tempUri.IsAbsoluteUri)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgument("uri", SR.GetString(SR.ID0013));
+            }
+
+            this.uri = tempUri;
+        }
+
+        public Uri Uri
+        {
+            get
+            {
+                return uri;
+            }
+        }
+
+        public void WriteTo(XmlWriter writer)
+        {
+            if (writer == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("writer");
+            }
+
+            writer.WriteStartElement(WSAddressing10Constants.Prefix, WSAddressing10Constants.Elements.EndpointReference, WSAddressing10Constants.NamespaceUri);
+
+            writer.WriteStartElement(WSAddressing10Constants.Prefix, WSAddressing10Constants.Elements.Address, WSAddressing10Constants.NamespaceUri);
+            writer.WriteString(this.Uri.AbsoluteUri);
+            writer.WriteEndElement();
+            foreach ( XmlElement element in _details )
+            {
+                element.WriteTo( writer );
+            }
+
+            writer.WriteEndElement();
+        }
+
+        /// <summary>
+        /// Reads an <see cref="EndpointReference"/> from xml reader.
+        /// </summary>
+        /// <param name="reader">The xml reader.</param>
+        /// <returns>An <see cref="EndpointReference"/> instance.</returns>
+        public static EndpointReference ReadFrom(XmlReader reader)
+        {
+            return ReadFrom(XmlDictionaryReader.CreateDictionaryReader(reader));
+        }
+
+        /// <summary>
+        /// Reads an <see cref="EndpointReference"/> from xml dictionary reader. The addressing version is defaulted to
+        /// <see cref="WSAddressing10Constants.Elements.Address"/>.
+        /// </summary>
+        /// <param name="reader">The xml dictionary reader.</param>
+        /// <returns>An <see cref="EndpointReference"/> instance.</returns>
+        public static EndpointReference ReadFrom(XmlDictionaryReader reader)
+        {
+            if (reader == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("reader");
+            }
+
+            reader.ReadFullStartElement();
+            reader.MoveToContent();
+
+            if (reader.IsNamespaceUri(WSAddressing10Constants.NamespaceUri) || reader.IsNamespaceUri(WSAddressing200408Constants.NamespaceUri))
+            {
+                if (reader.IsStartElement(WSAddressing10Constants.Elements.Address, WSAddressing10Constants.NamespaceUri) ||
+                    reader.IsStartElement(WSAddressing10Constants.Elements.Address, WSAddressing200408Constants.NamespaceUri))
+                {
+                    EndpointReference er = new EndpointReference(reader.ReadElementContentAsString());
+                    while ( reader.IsStartElement() )
+                    {
+                        bool emptyElement = reader.IsEmptyElement;
+                        
+                        XmlReader subtreeReader = reader.ReadSubtree();
+                        XmlDocument doc = new XmlDocument();
+                        doc.PreserveWhitespace = true;
+                        doc.Load( subtreeReader );
+                        er._details.Add( doc.DocumentElement );
+                        if ( !emptyElement )
+                        {
+                            reader.ReadEndElement();
+                        }
+                    }
+
+                    reader.ReadEndElement();
+                    return er;
+                }
+            }
+
+            return null;
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/Entropy.cs

@@ -0,0 +1,73 @@
+//-----------------------------------------------------------------------
+// <copyright file="Entropy.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.IdentityModel.Tokens;
+
+    /// <summary>
+    /// The Entropy used in both token request message and token response message. 
+    /// </summary>
+    public class Entropy : ProtectedKey
+    {
+        /// <summary>
+        /// Use this constructor to create an Entropy object with some randomly generated bytes.
+        /// </summary>
+        /// <param name="entropySizeInBits">The entropySizeInBits of the key material inside the entropy.</param>
+        public Entropy( int entropySizeInBits )
+            : this( CryptoHelper.GenerateRandomBytes( entropySizeInBits ) )
+        {
+        }
+
+        /// <summary>
+        /// Constructor for sending entropy in binary secret format.
+        /// </summary>
+        /// <param name="secret">The key material.</param>
+        public Entropy( byte[] secret )
+            : base( secret )
+        {
+        }
+
+        /// <summary>
+        /// Constructor for sending entropy in encrypted key format.
+        /// </summary>
+        /// <param name="secret">The key material.</param>
+        /// <param name="wrappingCredentials">The encrypting credentials used to encrypt the key material.</param>
+        public Entropy( byte[] secret, EncryptingCredentials wrappingCredentials )
+            : base( secret, wrappingCredentials )
+        {
+        }
+
+        /// <summary>
+        /// Constructs an entropy instance with the protected key.
+        /// </summary>
+        /// <param name="protectedKey">The protected key which can be either binary secret or encrypted key.</param>
+        public Entropy( ProtectedKey protectedKey )
+            : base( GetKeyBytesFromProtectedKey( protectedKey ), GetWrappingCredentialsFromProtectedKey( protectedKey ) )
+        {
+        }
+
+        static byte[] GetKeyBytesFromProtectedKey( ProtectedKey protectedKey )
+        {
+            if ( protectedKey == null )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "protectedKey" );
+            }
+
+            return protectedKey.GetKeyBytes();
+        }
+
+        static EncryptingCredentials GetWrappingCredentialsFromProtectedKey( ProtectedKey protectedKey )
+        {
+            if ( protectedKey == null )
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull( "protectedKey" );
+            }
+
+            return protectedKey.WrappingCredentials;
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/FederatedClientCredentialsParameters.cs

@@ -0,0 +1,48 @@
+//------------------------------------------------------------------------------
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+//------------------------------------------------------------------------------
+
+using System;
+using System.IdentityModel.Tokens;
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// Encapsulates the properties that impact the FederatedSecurityTokenProvider's token
+    /// retrieval logic.
+    /// </summary>
+    internal class FederatedClientCredentialsParameters
+    {
+        SecurityToken _actAs;
+        SecurityToken _onBehalfOf;
+        SecurityToken _issuedSecurityToken;
+
+        /// <summary>
+        /// Gets or sets the SecurityToken sent to the SecurityTokenService as the ActAs element.
+        /// </summary>
+        public SecurityToken ActAs
+        {
+            get { return _actAs; }
+            set { _actAs = value; }
+        }
+
+        /// <summary>
+        /// Gets or sets the SecurityToken sent to the SecurityTokenService as the OnBehalfOf element.
+        /// </summary>
+        public SecurityToken OnBehalfOf
+        {
+            get { return _onBehalfOf; }
+            set { _onBehalfOf = value; }
+        }
+
+        /// <summary>
+        /// Gets or sets the SecurityToken returned when the FederatedSecurityTokenProvider.GetTokenCore is called.
+        /// If this property is not set, a SecurityToken is retrieved from the configured SecurityTokenService as normal.
+        /// </summary>
+        public SecurityToken IssuedSecurityToken
+        {
+            get { return _issuedSecurityToken; }
+            set { _issuedSecurityToken = value; }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/InvalidRequestException.cs

@@ -0,0 +1,54 @@
+//-----------------------------------------------------------------------
+// <copyright file="InvalidRequestException.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.Runtime.Serialization;
+
+    /// <summary>
+    /// Throw this exception when the request was invalid or malformed.
+    /// </summary>
+    [Serializable]
+    public class InvalidRequestException : RequestException
+    {
+        /// <summary>
+        /// Default constructor.
+        /// </summary>
+        public InvalidRequestException()
+            : base( SR.GetString( SR.ID2005 ) )
+        {
+        }
+
+        /// <summary>
+        /// Constructor with message.
+        /// </summary>
+        /// <param name="message">The message describes what was causing the exception.</param>
+        public InvalidRequestException( string message )
+            : base( message )
+        {
+        }
+
+        /// <summary>
+        /// Constructor with message and inner exception.
+        /// </summary>
+        /// <param name="message">The message describes what was causing the exception.</param>
+        /// <param name="innerException">The inner exception indicates the real reason the exception was thrown.</param>
+        public InvalidRequestException( string message, Exception innerException )
+            : base( message, innerException )
+        {
+        }
+
+        /// <summary>
+        /// Constructor that sets the System.Runtime.Serialization.SerializationInfo with information about the exception.
+        /// </summary>
+        /// <param name="info">The <see cref="SerializationInfo"/> that holds the serialized object data about the exception being thrown.</param>
+        /// <param name="context">The <see cref="StreamingContext"/> that contains contextual information about the source or destination.</param>
+        protected InvalidRequestException( SerializationInfo info, StreamingContext context )
+            : base( info, context )
+        {
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/KeyTypes.cs

@@ -0,0 +1,20 @@
+//-----------------------------------------------------------------------
+// <copyright file="KeyTypes.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{   
+    /// <summary>
+    /// Used in the RST or RSTR to indicated the desired or required key type. 
+    /// </summary>
+    public static class KeyTypes
+    {
+#pragma warning disable 1591
+        public const string Symmetric = "http://schemas.microsoft.com/idfx/keytype/symmetric";
+        public const string Asymmetric = "http://schemas.microsoft.com/idfx/keytype/asymmetric";
+        public const string Bearer = "http://schemas.microsoft.com/idfx/keytype/bearer";
+#pragma warning restore 1591
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/Lifetime.cs

@@ -0,0 +1,79 @@
+//-----------------------------------------------------------------------
+// <copyright file="Lifetime.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System;
+    using System.Diagnostics;
+
+    /// <summary>
+    /// Used in the RequestSecurityToken or RequestSecurityTokenResponse to indicated the desired or 
+    /// required lifetime of a token. Everything here is stored in Utc format.
+    /// </summary>
+    public class Lifetime
+    {
+        DateTime? _created;
+        DateTime? _expires;
+
+        /// <summary>
+        /// Instantiates a LifeTime object with token creation and expiration time in Utc.
+        /// </summary>
+        /// <param name="created">Token creation time in Utc.</param>
+        /// <param name="expires">Token expiration time in Utc.</param>
+        /// <exception cref="ArgumentException">When the given expiration time is 
+        /// before the given creation time.</exception>
+        public Lifetime( DateTime created, DateTime expires )
+            : this( (DateTime?)created, (DateTime?)expires )
+        {
+        }
+
+        /// <summary>
+        /// Instantiates a LifeTime object with token creation and expiration time in Utc.
+        /// </summary>
+        /// <param name="created">Token creation time in Utc.</param>
+        /// <param name="expires">Token expiration time in Utc.</param>
+        /// <exception cref="ArgumentException">When the given expiration time is 
+        /// before the given creation time.</exception>
+        public Lifetime( DateTime? created, DateTime? expires )
+        {
+            if ( created != null && expires != null && expires.Value <= created.Value )
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError( new ArgumentException( SR.GetString( SR.ID2000 ) ) );
+
+            _created = DateTimeUtil.ToUniversalTime( created );
+            _expires = DateTimeUtil.ToUniversalTime( expires );
+        }
+
+        /// <summary>
+        /// Gets the token creation time in UTC time.
+        /// </summary>
+        public DateTime? Created
+        {
+            get 
+            { 
+                return _created; 
+            }
+            set
+            {
+                _created = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets the token expiration time in UTC time.
+        /// </summary>
+        public DateTime? Expires
+        {
+            get 
+            { 
+                return _expires; 
+            }
+            set
+            {
+                _expires = value;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/Participants.cs

@@ -0,0 +1,48 @@
+//-----------------------------------------------------------------------
+// <copyright file="Participants.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.Collections.Generic;
+
+    /// <summary>
+    /// Defines the &lt;wst:Participants> elements. This element is an extension to
+    /// the &lt;wst:RequestSecurityToken element for passing information about which 
+    /// parties are authorized to participate in the use of the token.
+    /// </summary>
+    public class Participants
+    {
+        EndpointReference _primary;
+        List<EndpointReference> _participant = new List<EndpointReference>();
+
+        /// <summary>
+        /// Gets the Primary user of the Issued Token.
+        /// </summary>
+        public EndpointReference Primary
+        {
+            get
+            {
+                return _primary;
+            }
+            set
+            {
+                _primary = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets the list of Participants who are allowed to use
+        /// the token.
+        /// </summary>
+        public List<EndpointReference> Participant
+        {
+            get
+            {
+                return _participant;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/ProtectedKey.cs

@@ -0,0 +1,60 @@
+//-----------------------------------------------------------------------
+// <copyright file="ProtectedKey.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.IdentityModel.Tokens;
+
+    /// <summary>
+    /// This class are used in defining Entropy and RequestProofToken element inside the 
+    /// RequestSecurityToken and RequestSecurityTokenResponse.
+    /// </summary>
+    public class ProtectedKey
+    {
+        byte[] _secret;
+        EncryptingCredentials _wrappingCredentials;
+        
+        /// <summary>
+        /// Use this constructor if we want to send the key material in clear text.
+        /// </summary>
+        /// <param name="secret">The key material that needs to be protected.</param>
+        public ProtectedKey(byte[] secret)
+        {
+            _secret = secret;
+        }
+
+        /// <summary>
+        /// Use this constructor if we want to send the key material encrypted.
+        /// </summary>
+        /// <param name="secret">The key material that needs to be protected.</param>
+        /// <param name="wrappingCredentials">The encrypting credentials used to encrypt the key material.</param>
+        public ProtectedKey(byte[] secret, EncryptingCredentials wrappingCredentials)
+        {
+            _secret = secret;
+            _wrappingCredentials = wrappingCredentials;
+        }
+
+        /// <summary>
+        /// Gets the key material.
+        /// </summary>
+        public byte[] GetKeyBytes()
+        {
+            return _secret;
+        }
+
+        /// <summary>
+        /// Gets the encrypting credentials. Null means that the keys are not encrypted.
+        /// </summary>
+        public EncryptingCredentials WrappingCredentials
+        {
+            get 
+            { 
+                return _wrappingCredentials; 
+            }
+        }
+    }
+}
+

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/Renewing.cs

@@ -0,0 +1,83 @@
+//-----------------------------------------------------------------------
+// <copyright file="Renewing.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// This defines the Renewing element inside the RequestSecurityToken message. 
+    /// </summary>
+    /// <remarks>
+    /// The presence of Renewing element indicates the token issuer that the requested token
+    /// can be renewed if allow attribute is true, and the token can be renewed after
+    /// it expires if ok is true.
+    /// </remarks>
+    public class Renewing
+    {
+        bool _allowRenewal = true;
+        bool _okForRenewalAfterExpiration; // false by default
+
+        /// <summary>
+        /// Initializes a renewing object with AllowRenewal attribute equals to true, and 
+        /// OkForRenewalAfterExpiration attribute equals false.
+        /// </summary>
+        public Renewing()
+        {
+        }
+
+        /// <summary>
+        /// Initializes a renewing object with specified allow and OK attributes.
+        /// </summary>
+        public Renewing( bool allowRenewal, bool okForRenewalAfterExpiration )
+        {
+            _allowRenewal = allowRenewal;
+            _okForRenewalAfterExpiration = okForRenewalAfterExpiration;
+        }
+
+        /// <summary>
+        /// Returns true if it is allowed to renew this token.
+        /// </summary>
+        /// <remarks>
+        /// This optional boolean attribute is used to request a renewable token. Default value is true. 
+        /// </remarks>
+        /// <devdocs>
+        /// Please refer to section 7 in the WS-Trust spec for more details.
+        /// </devdocs>
+        public bool AllowRenewal
+        {
+            get
+            {
+                return _allowRenewal;
+            }
+            set
+            {
+                _allowRenewal = value;
+            }
+        }
+
+        /// <summary>
+        /// Returns true if the requested token can be renewed after it expires.
+        /// </summary>
+        /// <remarks>
+        /// This optional boolean attriubte is used to indicate that a renewable token is acceptable if
+        /// the requested duration exceeds the limit of the issuance service. That is, if true, then the 
+        /// token can be renewed after their expiration. Default value is false for security reason. 
+        /// </remarks>
+        /// <devdocs>
+        /// Please refer to section 7 in the WS-Trust spec for more details.
+        /// </devdocs>
+        public bool OkForRenewalAfterExpiration
+        {
+            get
+            {
+                return _okForRenewalAfterExpiration;
+            }
+            set
+            {
+                _okForRenewalAfterExpiration = value;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestClaim.cs

@@ -0,0 +1,100 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestClaim.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// This class is used to represent the Request Claims collection inside RequestSecurityToken.
+    /// Indicate whether the claim is optional or not. 
+    /// </summary>
+    public class RequestClaim
+    {
+        string _claimType;
+        bool _isOptional;
+        string _value;
+
+        /// <summary>
+        /// Instantiates a required RequestClaim instance with ClaimType Uri. 
+        /// </summary>
+        /// <param name="claimType">ClaimType Uri attribute.</param>
+        public RequestClaim(string claimType)
+            : this(claimType, false)
+        {
+        }
+
+        /// <summary>
+        /// Instantiates a RequestClaim instance with ClaimType Uri and inidicates whether it is 
+        /// optional.
+        /// </summary>
+        /// <param name="claimType">The ClaimType Uri attribute.</param>
+        /// <param name="isOptional">The ClaimType Optional attribute.</param>
+        public RequestClaim(string claimType, bool isOptional)
+            : this(claimType, isOptional, null)
+        {
+        }
+
+        /// <summary>
+        /// Instantiates a RequestClaim instance with ClaimType Uri, the flag to inidicate whether it is 
+        /// optional and the value of the request.
+        /// </summary>
+        /// <param name="claimType">The ClaimType Uri attribute.</param>
+        /// <param name="isOptional">The ClaimType Optional attribute.</param>
+        /// <param name="value">The actual value of the claim.</param>
+        public RequestClaim(string claimType, bool isOptional, string value)
+        {
+            if (string.IsNullOrEmpty(claimType))
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperError(new ArgumentException(SR.GetString(SR.ID0006), "claimType"));
+            }
+
+            _claimType = claimType;
+            _isOptional = isOptional;
+            _value = value;
+        }
+
+        /// <summary>
+        /// Gets ClaimType uri attribute.
+        /// </summary>
+        public string ClaimType
+        {
+            get
+            {
+                return _claimType;
+            }
+        }
+
+        /// <summary>
+        /// Gets ClaimType optional attribute.
+        /// </summary>
+        public bool IsOptional
+        {
+            get
+            {
+                return _isOptional;
+            }
+            set
+            {
+                _isOptional = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets ClaimType value element.
+        /// </summary>
+        public string Value
+        {
+            get
+            {
+                return _value;
+            }
+            set
+            {
+                _value = value;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestClaimCollection.cs

@@ -0,0 +1,40 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestClaimCollection.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.Collections.ObjectModel;
+
+    /// <summary>
+    /// This class is used to represent a collection of the RequestClaims inside RequestSecurityToken.
+    /// </summary>
+    public class RequestClaimCollection : Collection<RequestClaim>
+    {
+        string _dialect = WSIdentityConstants.Dialect;
+
+        /// <summary>
+        /// Instantiates an empty requested claim collection.
+        /// </summary>
+        public RequestClaimCollection()
+        {
+        }
+
+        /// <summary>
+        /// Gets or sets the Claims dialect attribute.
+        /// </summary>
+        public string Dialect
+        {
+            get 
+            { 
+                return _dialect; 
+            }
+            set 
+            { 
+                _dialect = value; 
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestSecurityToken.cs

@@ -0,0 +1,365 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestSecurityToken.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.IdentityModel.Tokens;
+    using System.IdentityModel.Configuration;
+
+    /// <summary>
+    /// The class defines the wst:RequestSecurityToken element which 
+    /// is used to request a security token.
+    /// </summary>
+    public class RequestSecurityToken : WSTrustMessage
+    {
+        AdditionalContext _additionalContext;
+        RequestClaimCollection _claims;
+        string _computedKeyAlgorithm;
+        Renewing _renewing;
+        SecurityTokenElement _renewTarget;
+        SecurityTokenElement _proofEncryption;
+        RequestSecurityToken _secondaryParameters;
+        SecurityTokenElement _onBehalfOf;
+        EndpointReference _onBehalfOfIssuer;
+        SecurityTokenElement _actAs;
+        SecurityTokenElement _delegateTo;
+        bool? _forwardable;
+        bool? _delegatable;
+        SecurityTokenElement _cancelTarget;
+        SecurityTokenElement _validateTarget;
+        Participants _participants;
+        SecurityTokenElement _encryption;
+
+        /// <summary>
+        /// This constructor is usually used on the receiving end.
+        /// </summary>
+        public RequestSecurityToken()
+            : this(null, null)
+        {
+        }
+
+        /// <summary>
+        /// This constructor is usually used on the sending side to instantiate a
+        /// instance of RST based on the request type and its string value.
+        /// </summary>
+        public RequestSecurityToken(string requestType)
+            : this(requestType, null)
+        {
+        }
+
+        /// <summary>
+        /// This constructor is usually used on the sending side to instantiate a
+        /// instance of RST based on the request type and its string value.
+        /// </summary>
+        public RequestSecurityToken(string requestType, string keyType)
+            : base()
+        {
+            RequestType = requestType;
+
+            if (keyType == KeyTypes.Symmetric)
+            {
+                Entropy = new Entropy(SecurityTokenServiceConfiguration.DefaultKeySizeInBitsConstant);
+                KeySizeInBits = SecurityTokenServiceConfiguration.DefaultKeySizeInBitsConstant;
+            }
+            else if (keyType == KeyTypes.Bearer)
+            {
+                KeySizeInBits = 0;
+            }
+            else if (keyType == KeyTypes.Asymmetric)
+            {
+                KeySizeInBits = 1024;
+            }
+
+            KeyType = keyType;
+        }
+
+        /// <summary>
+        /// The optional element requests a specific set of claim types requested by the client.
+        /// </summary>
+        public RequestClaimCollection Claims
+        {
+            get
+            {
+                if (_claims == null)
+                {
+                    _claims = new RequestClaimCollection();
+                }
+
+                return _claims;
+            }
+        }
+
+        /// <summary>
+        /// The optional element provides that provides information on the token/key to use when encrypting
+        /// </summary>
+        public SecurityTokenElement Encryption
+        {
+            get
+            {
+                return _encryption;
+            }
+
+            set
+            {
+                _encryption = value;
+            }
+        }
+
+        /// <summary>
+        /// This optional URI element indicates the desired algorithm to use when computed
+        /// key are used for issued tokens.
+        /// </summary>
+        /// <remarks>
+        /// This is an extension to the RequestSecurityToken element.
+        /// </remarks>
+        /// <devdocs>
+        ///  It is defined in the section 11.2 in the WS-Trust spec.
+        /// </devdocs>
+        public string ComputedKeyAlgorithm
+        {
+            get
+            {
+                return _computedKeyAlgorithm;
+            }
+
+            set
+            {
+                _computedKeyAlgorithm = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or Sets a boolean that specifies if the returned token should
+        /// be delegatable.
+        /// </summary>
+        public bool? Delegatable
+        {
+            get
+            {
+                return _delegatable;
+            }
+
+            set
+            {
+                _delegatable = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or Sets the Identity to which the Issued Token is delegated to.
+        /// </summary>
+        public SecurityTokenElement DelegateTo
+        {
+            get
+            {
+                return _delegateTo;
+            }
+
+            set
+            {
+                _delegateTo = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or Sets a boolean that specifies if the Issued Token should
+        /// be marked forwardable.
+        /// </summary>
+        public bool? Forwardable
+        {
+            get
+            {
+                return _forwardable;
+            }
+
+            set
+            {
+                _forwardable = value;
+            }
+        }
+
+        /// <summary>
+        /// This optional element indicates that the requestor is making the request 
+        /// on behalf of another.
+        /// </summary>
+        public SecurityTokenElement OnBehalfOf
+        {
+            get
+            {
+                return _onBehalfOf;
+            }
+
+            set
+            {
+                _onBehalfOf = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or Sets the Participants who are authorized to use
+        /// the issued token.
+        /// </summary>
+        public Participants Participants
+        {
+            get
+            {
+                return _participants;
+            }
+
+            set
+            {
+                _participants = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets/Sets the Issuer of the OnBehalfOf token.
+        /// </summary>
+        public EndpointReference Issuer
+        {
+            get
+            {
+                return _onBehalfOfIssuer;
+            }
+
+            set
+            {
+                _onBehalfOfIssuer = value;
+            }
+        }
+
+        /// <summary>
+        /// This is a optional element that provides additional information
+        /// for authorization decision.
+        /// </summary>
+        public AdditionalContext AdditionalContext
+        {
+            get
+            {
+                return _additionalContext;
+            }
+
+            set
+            {
+                _additionalContext = value;
+            }
+        }
+
+        /// <summary>
+        /// This optional element indicates that the requestor is making the request 
+        /// on to act as another.
+        /// </summary>
+        public SecurityTokenElement ActAs
+        {
+            get
+            {
+                return _actAs;
+            }
+
+            set
+            {
+                _actAs = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or Sets the Token that is requested to be cancelled.
+        /// </summary>
+        public SecurityTokenElement CancelTarget
+        {
+            get
+            {
+                return _cancelTarget;
+            }
+
+            set
+            {
+                _cancelTarget = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the SecurityToken to be used to encrypt the proof token.
+        /// </summary>
+        public SecurityTokenElement ProofEncryption
+        {
+            get
+            {
+                return _proofEncryption;
+            }
+
+            set
+            {
+                _proofEncryption = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the Renewing element inside the RequestSecurityToken message.
+        /// </summary>
+        public Renewing Renewing
+        {
+            get
+            {
+                return _renewing;
+            }
+
+            set
+            {
+                _renewing = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the RenewTarget element inside the RequestSecurityToken message.
+        /// </summary>
+        public SecurityTokenElement RenewTarget
+        {
+            get
+            {
+                return _renewTarget;
+            }
+
+            set
+            {
+                _renewTarget = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the SecondaryParameters inside the RequestSecurityToken message.
+        /// This represents the information for which the requestor is not the orginator. The STS MAY choose to use values found here.
+        /// </summary>
+        public RequestSecurityToken SecondaryParameters
+        {
+            get
+            {
+                return _secondaryParameters;
+            }
+
+            set
+            {
+                _secondaryParameters = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or Sets the Security Token to be Validated.
+        /// </summary>
+        public SecurityTokenElement ValidateTarget
+        {
+            get
+            {
+                return _validateTarget;
+            }
+
+            set
+            {
+                _validateTarget = value;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestSecurityTokenResponse.cs

@@ -0,0 +1,180 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestSecurityTokenResponse.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.IdentityModel.Tokens;
+
+    /// <summary>
+    /// The class defines the wst:RequestSecurityTokenResponse element which 
+    /// is used to return a security token.
+    /// </summary>
+    public class RequestSecurityTokenResponse : WSTrustMessage
+    {
+        SecurityKeyIdentifierClause _requestedAttachedReference;
+        RequestedProofToken _requestedProofToken;
+        RequestedSecurityToken _requestedSecurityToken;
+        SecurityKeyIdentifierClause _requestedUnattachedReference;
+        bool _requestedTokenCancelled;
+        Status _status;
+        bool _isFinal = true;
+
+        /// <summary>
+        /// This constructor is usually used on the RSTR receiving end.
+        /// </summary>
+        public RequestSecurityTokenResponse()
+            : base()
+        {
+        }
+
+        /// <summary>
+        /// This constructor is usually used on the RSTR sending side.
+        /// </summary>
+        /// <remarks>
+        /// This constructor will copy some information, such as Context, KeyType, 
+        /// KeySize and RequestType from the request message. Note here the RequestType
+        /// is not a sub element under RSTR, need it just for token request processing.
+        /// </remarks>
+        public RequestSecurityTokenResponse(WSTrustMessage message)
+            : base()
+        {
+            if (message == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("message");
+            }
+
+            RequestType = message.RequestType;  // note this is NOT a sub element under RSTR
+            Context = message.Context;
+            KeyType = message.KeyType;
+
+            if (message.KeySizeInBits > 0 && StringComparer.Ordinal.Equals(message.KeyType, KeyTypes.Symmetric))
+            {
+                KeySizeInBits = message.KeySizeInBits;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the flag that determines if the RSTR is the final message
+        /// and should be serialized as such.
+        /// </summary>
+        /// <remarks>
+        /// This flag is only useful if the version of WS-Trust provides rules for serializing
+        /// the final RSTR in a message flow. For instance, WS-Trust 1.3 requires the final RSTR
+        /// to be enclosed within a RequestSecurityTokenResponseCollection element.
+        /// </remarks>
+        public bool IsFinal
+        {
+            get
+            {
+                return _isFinal;
+            }
+            set
+            {
+                _isFinal = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the security token reference when the requested token is attached 
+        /// to the message.
+        /// </summary>
+        /// <remarks>
+        /// This optional element is specified to indicate how to reference the returned token when 
+        /// that token doesn't support references using URI fragments.
+        /// </remarks>
+        public SecurityKeyIdentifierClause RequestedAttachedReference
+        {
+            get
+            {
+                return _requestedAttachedReference;
+            }
+            set
+            {
+                _requestedAttachedReference = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the optional elemnet used to return the requested security token.
+        /// </summary>
+        public RequestedSecurityToken RequestedSecurityToken
+        {
+            get
+            {
+                return _requestedSecurityToken;
+            }
+            set
+            {
+                _requestedSecurityToken = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the optional elemnet used to return the proof of possession token.
+        /// </summary>
+        public RequestedProofToken RequestedProofToken
+        {
+            get
+            {
+                return _requestedProofToken;
+            }
+            set
+            {
+                _requestedProofToken = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the security token reference when the requested token is not attached 
+        /// to the message.
+        /// </summary>
+        /// <remarks>
+        /// This optional element is specified to indicate how to reference the returned token when 
+        /// that token is not placed in the message.
+        /// </remarks>
+        public SecurityKeyIdentifierClause RequestedUnattachedReference
+        {
+            get
+            {
+                return _requestedUnattachedReference;
+            }
+            set
+            {
+                _requestedUnattachedReference = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the RequestedTokenCancelled element.
+        /// </summary>
+        public bool RequestedTokenCancelled
+        {
+            get
+            {
+                return _requestedTokenCancelled;
+            }
+            set
+            {
+                _requestedTokenCancelled = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the Status element in the RSTR.
+        /// </summary>
+        public Status Status
+        {
+            get
+            {
+                return _status;
+            }
+            set
+            {
+                _status = value;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestTypes.cs

@@ -0,0 +1,24 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestTypes.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// This classes defines the protocol aganostic RequestType strings.  
+    /// </summary>
+    public static class RequestTypes 
+    {
+#pragma warning disable 1591
+        public const string Cancel = "http://schemas.microsoft.com/idfx/requesttype/cancel";
+        public const string Issue = "http://schemas.microsoft.com/idfx/requesttype/issue";
+        public const string Renew = "http://schemas.microsoft.com/idfx/requesttype/renew";
+        public const string Validate = "http://schemas.microsoft.com/idfx/requesttype/validate";
+
+        public const string IssueCard = "http://schemas.microsoft.com/idfx/requesttype/issueCard";
+        public const string GetMetadata = "http://schemas.microsoft.com/idfx/requesttype/getMetadata";
+#pragma warning restore 1591
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestedProofToken.cs

@@ -0,0 +1,98 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestedProofToken.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.IdentityModel.Tokens;
+
+    /// <summary>
+    /// The content of a RequestedProofToken element could be EncryptedSecurityToken which means that EncryptedKey is used 
+    /// under the RequestedProofToken. If the security token is a regular token, such as a SCT,
+    /// then its session key will be the material which gets encrypted.  Another possibility is where
+    /// we use combined entropy, then RequestedProofToken will only contain a ComputedKey element.
+    /// </summary>
+    public class RequestedProofToken
+    {
+        string _computedKeyAlgorithm;
+        ProtectedKey _keys;
+
+        /// <summary>
+        /// In case of combined entropy, construct a requestedprooftoken 
+        /// instance with computed key algorithm to specify the algorithm used to 
+        /// calculate the session key.
+        /// </summary>
+        /// <param name="computedKeyAlgorithm">The algorithm used to computed the session key in 
+        /// the combined entropy case.</param>
+        public RequestedProofToken(string computedKeyAlgorithm)
+            : base()
+        {
+            if (string.IsNullOrEmpty(computedKeyAlgorithm))
+            {
+                DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("computedKeyAlgorithm");
+            }
+
+            _computedKeyAlgorithm = computedKeyAlgorithm;
+        }
+
+        /// <summary>
+        /// When the requested proof token contains real key in plain text.
+        /// </summary>
+        /// <param name="secret">The key material.</param>
+        public RequestedProofToken(byte[] secret)
+        {
+            _keys = new ProtectedKey(secret);
+        }
+
+        /// <summary>
+        /// When the requested proof token contains real key encrypted.
+        /// </summary>
+        /// <param name="secret">The key material.</param>
+        /// <param name="wrappingCredentials">The encrypting credentials to encrypt the key material.</param>
+        public RequestedProofToken(byte[] secret, EncryptingCredentials wrappingCredentials)
+        {
+            _keys = new ProtectedKey(secret, wrappingCredentials);
+        }
+
+        /// <summary>
+        /// Constructs a requested proof token instance with the protected key.
+        /// </summary>
+        /// <param name="protectedKey">The protected key which can be either binary secret or encrypted key.</param>
+        public RequestedProofToken(ProtectedKey protectedKey)
+        {
+            if (protectedKey == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("protectedKey");
+            }
+
+            _keys = protectedKey;
+        }
+
+        /// <summary>
+        /// Gets the computed key algorithm used to calculate the session key in the combined 
+        /// entropy case.
+        /// </summary>
+        public string ComputedKeyAlgorithm
+        {
+            get
+            {
+                return _computedKeyAlgorithm;
+            }
+        }
+
+        /// <summary>
+        /// In the case when the requested proof token contains the real key, 
+        /// ProtectedKey getter will returns the real key bytes either encrypted
+        /// or plaintext.
+        /// </summary>
+        public ProtectedKey ProtectedKey
+        {
+            get
+            {
+                return _keys;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/RequestedSecurityToken.cs

@@ -0,0 +1,78 @@
+//-----------------------------------------------------------------------
+// <copyright file="RequestedSecurityToken.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    using System.IdentityModel.Tokens;
+    using System.Xml;
+
+    /// <summary>
+    /// This class defines the requested security token which is usually opaque to 
+    /// the token requestor.
+    /// </summary>
+    public class RequestedSecurityToken
+    {
+        XmlElement _tokenAsXml;
+        SecurityToken _requestedToken;
+
+        /// <summary>
+        /// Creates an instance of RequestedSecurityToken using the issued token. This is usually used 
+        /// on the token issuer end.
+        /// </summary>
+        /// <param name="token">The Security token requested.</param>
+        public RequestedSecurityToken(SecurityToken token)
+        {
+            if (token == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("token");
+            }
+
+            _requestedToken = token;
+        }
+
+        /// <summary>
+        /// Creates an instance of RequestedSecurityToken using the token xml. This is usually used on the 
+        /// token receiving end.
+        /// </summary>
+        /// <param name="tokenAsXml">XML representation of the token.</param>
+        public RequestedSecurityToken(XmlElement tokenAsXml)
+        {
+            if (tokenAsXml == null)
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("tokenAsXml");
+            }
+
+            _tokenAsXml = tokenAsXml;
+        }
+
+        /// <summary>
+        /// Returns the XML representation of the token when the RequestedSecurityToken was constructed 
+        /// using the token xml. This property getter could return null if the RequestedSecurityToken was constructed
+        /// using a security token.
+        /// </summary>
+        public virtual XmlElement SecurityTokenXml
+        {
+            get
+            {
+                return _tokenAsXml;
+            }
+        }
+
+        /// <summary>
+        /// Gets the issued security token when the RequestedSecurityToken was constructed using the token 
+        /// itself. This property getter could return null if the RequestedSecurityToken was constructed using the 
+        /// token xml. 
+        /// </summary>
+        public SecurityToken SecurityToken
+        {
+            get
+            {
+                return _requestedToken;
+            }
+        }
+    }
+}

mcs/class/referencesource/System.IdentityModel/System/IdentityModel/Protocols/WSTrust/Status.cs

@@ -0,0 +1,70 @@
+//-----------------------------------------------------------------------
+// <copyright file="Status.cs" company="Microsoft">
+//     Copyright (c) Microsoft Corporation.  All rights reserved.
+// </copyright>
+//-----------------------------------------------------------------------
+
+namespace System.IdentityModel.Protocols.WSTrust
+{
+    /// <summary>
+    /// A class encapsulating the result of a WS-Trust request.
+    /// </summary>
+    public class Status
+    {
+        string _code;
+        string _reason;
+
+        /// <summary>
+        /// Creates an instance of Status
+        /// </summary>
+        /// <param name="code">Status code.</param>
+        /// <param name="reason">Optional status reason.</param>
+        public Status(string code, string reason)
+        {
+            if (string.IsNullOrEmpty(code))
+            {
+                throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("code");
+            }
+
+            _code = code;
+            _reason = reason;
+        }
+
+        /// <summary>
+        /// Gets or sets the status code for the validation binding in the RSTR.
+        /// </summary>
+        public string Code
+        {
+            get
+            {
+                return _code;
+            }
+
+            set
+            {
+                if (string.IsNullOrEmpty(value))
+                {
+                    throw DiagnosticUtility.ExceptionUtility.ThrowHelperArgumentNull("code");
+                }
+
+                _code = value;
+            }
+        }
+
+        /// <summary>
+        /// Gets or sets the optional status reason for the validation binding in the RSTR.
+        /// </summary>
+        public string Reason
+        {
+            get
+            {
+                return _reason;
+            }
+
+            set
+            {
+                _reason = value;
+            }
+        }
+    }
+}