WSDL Needs

Obviously, what the CRM service, Organization or Discovery, says about authentication must be consistent with what the ADFS server says. Fortunately, they are consistent. The CRM server service WDSL also indicate the specific token format that will be used.

Here's the section of the WDSL dealing with the security policy. The sections that are the same as the ADFS server have been collapsed.

<wsp:Policy wsu:Id="CustomBinding_IDiscoveryService_policy">
    <wsp:ExactlyOne>
      <wsp:All>
        <ms-xrm:AuthenticationPolicy xmlns:ms-xrm="http://schemas.microsoft.com/xrm/2011/Contracts/Services">
          <ms-xrm:Authentication>Federation</ms-xrm:Authentication>
          <ms-xrm:SecureTokenService>
            <ms-xrm:Identifier>http://crm.demo.local/adfs/services/trust</ms-xrm:Identifier>
          </ms-xrm:SecureTokenService>
        </ms-xrm:AuthenticationPolicy>
        <sp:TransportBinding xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
          <wsp:Policy>
            <sp:TransportToken>
              <wsp:Policy>
                <sp:HttpsToken/>
              </wsp:Policy>
            </sp:TransportToken>
            <sp:AlgorithmSuite>
              <wsp:Policy>
                <sp:Basic256/>
              </wsp:Policy>
            </sp:AlgorithmSuite>
            <sp:Layout>
              <wsp:Policy>
                <sp:Strict/>
              </wsp:Policy>
            </sp:Layout>
            <sp:IncludeTimestamp/>
          </wsp:Policy>
        </sp:TransportBinding>
        <sp:EndorsingSupportingTokens xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
          <wsp:Policy>
            <sp:IssuedToken sp:IncludeToken="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702/IncludeToken/AlwaysToRecipient">
              <Issuer xmlns="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
                <Address xmlns="http://www.w3.org/2005/08/addressing">http://www.w3.org/2005/08/addressing/anonymous</Address>
                <Metadata xmlns="http://www.w3.org/2005/08/addressing">
                  <Metadata xmlns="http://schemas.xmlsoap.org/ws/2004/09/mex" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
                    <wsx:MetadataSection xmlns="">
                      <wsx:MetadataReference>
                        <Address xmlns="http://www.w3.org/2005/08/addressing">https://crm.demo.local/adfs/services/trust/mex</Address>
                      </wsx:MetadataReference>
                    </wsx:MetadataSection>
                  </Metadata>
                </Metadata>
              </Issuer>
              <sp:RequestSecurityTokenTemplate>
                <trust:KeyType xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://docs.oasis-open.org/ws-sx/ws-trust/200512/SymmetricKey</trust:KeyType>
                <trust:KeySize xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">256</trust:KeySize>
                <trust:Claims Dialect="http://schemas.xmlsoap.org/ws/2005/05/identity" xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">
                  <wsid:ClaimType Uri="http://schemas.xmlsoap.org/ws/2005/05/identity/claims/upn" xmlns:wsid="http://schemas.xmlsoap.org/ws/2005/05/identity"/>
                </trust:Claims>
                <trust:KeyWrapAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p</trust:KeyWrapAlgorithm>
                <trust:EncryptWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptWith>
                <trust:SignWith xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2000/09/xmldsig#hmac-sha1</trust:SignWith>
                <trust:CanonicalizationAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/10/xml-exc-c14n#</trust:CanonicalizationAlgorithm>
                <trust:EncryptionAlgorithm xmlns:trust="http://docs.oasis-open.org/ws-sx/ws-trust/200512">http://www.w3.org/2001/04/xmlenc#aes256-cbc</trust:EncryptionAlgorithm>
              </sp:RequestSecurityTokenTemplate>
              <wsp:Policy>
                <sp:RequireInternalReference/>
              </wsp:Policy>
            </sp:IssuedToken>
          </wsp:Policy>
        </sp:EndorsingSupportingTokens>
        <sp:Wss11 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
          <wsp:Policy/>
        </sp:Wss11>
        <sp:Trust13 xmlns:sp="http://docs.oasis-open.org/ws-sx/ws-securitypolicy/200702">
          <wsp:Policy>
            <sp:MustSupportIssuedTokens/>
            <sp:RequireClientEntropy/>
            <sp:RequireServerEntropy/>
          </wsp:Policy>
        </sp:Trust13>
        <wsaw:UsingAddressing/>
      </wsp:All>
    </wsp:ExactlyOne>
  </wsp:Policy>

We can see that it is consistent and that a "template" section has been added so we know how to form a RST (Request Security Token) request.

One of the policies of note is sp:RequireInternalReference. This policy assertion indicates that the message signature must include an element that is internally included i.e. an element should be included in the signature that comes from the header. For CRM, you can include the Timestamp element in the signature to satisfy this need for an internal element, a common inclusion.