RequestedSecurityToken

RequestedSecurityToken is an element used in the WS-Trust security framework to convey the actual issued token from a Security Token Service (STS) to a requester. It appears within a RequestSecurityTokenResponse (RSTR) message and serves as the container for the token that the client is entitled to use for accessing a protected resource.

In a typical interaction, a client sends a RequestSecurityToken (RST) to an STS to obtain a token. The STS processes the request and responds with an RSTR that includes a RequestedSecurityToken element. Inside this element is the issued token, which can be a SAML assertion, a Kerberos ticket, or another token form defined by the TokenType associated with the response. The token type and other metadata are provided by adjacent elements in the RSTR, such as TokenType and Lifetime.

Structure and semantics are defined by the WS-Trust specification. The RequestedSecurityToken element directly contains the token data, which the relying party validates and uses to authorize access to the requested service. The exact representation of the token depends on the token type and the issuing STS’s configuration, but the pattern remains: the RSTR delivers the token to the caller inside RequestedSecurityToken.

Security considerations include protecting the token against eavesdropping and tampering, typically through transport-layer security (such as TLS) and proper validation of the token’s issuer, audience, and lifetime. Proper handling of the token is essential to maintain the integrity of the authentication and authorization process.

See also: WS-Trust, RequestSecurityToken, RequestSecurityTokenResponse, Security Token Service, SAML.