External Security Token Service issues

When I follow the provided instructions here:

www.sitefinity.com/.../setting-up-sso-with-windows-authentication

Most things work as expected except for the occasional infinite redirect loop, but when I pull up a page in the cms backend and edit it I get this error when I try to publish:

The HTTP request is unauthorized with client authentication scheme 'Anonymous'. The authentication header received from the server was 'Negotiate,NTLM'

I also wrote a variation of the token service to use out standard third party auth and when I publish after logging in with that I get:

Return code: 0

When I examine the IIS logs I can see that an attempt to call
/DefaultWorkflows/PagesApprovalWorkflow.xamlx
resulted in the client side javascript being 302'ed to the login page at which point it seems to abort the request.

Whatever is running the backend services is not acknowledging the login state of the client when I use an external STS.

In the customized token service I have pretty much everything working except the backend services and role updates.  I cannot get a person's role claims to be recognized when they log out and log back in after having their roles changed in the 3rd party user data store.  Whenever someone logs in their roles are stuck until i recycle the worker pool for the sitefinity site regardless of what the STS is indicating in claims on later logins.

NT auth and sitefinity's built in basic auth are simply not acceptable solutions for our customers.  This wasn't to difficult to correct in 3.7 but looks like it might be a dealbreaker for doing new projects sitefinity in the future if we cannot correct it.

edit: forgot to include that I am using sitefinity 5.0.2523.0 on windows 7 using iis 7.5

Probably not much help but, I have just checked and I can publish pages when using an external STS.
I am using Sitefinity 5.0.2860.0 on Windows 7 IIS7.5.
My user is BackendUser AND Administrator, I did notice that I have sometimes needed to re-start IIS and to make security changes propegate through to my browser.

Just downloaded SF 5.1 new 5.1 example STS for download but looks like same code, in slightly different format. Fingers crossed :)

Some feedback that is actually can work is useful and since you are on a later version maybe I need to wipe this installation and start over if I end up spending too much more time without making progress.

Out of curiosity, in your earlier post it sounded like you intended to mod the sts example to your own needs.  If you did that could you offer some hint at what you changed?

My requirements were:
Use existing forms based database
Use Custom role provider
Only Sign in once to have filtered content in Sitefnity, but to also use our backend websites.

I have modified the Sts so that the authentication is forms based and uses our existing db, I amended the SimpleWebTokenHandler.cs slightly see below. I also had to point sitefinity at our forms databaase. Security.config and web.config change. I'll post a full description on my other thread this evening.

That is pretty much the same thing I did along with many variants of issuing the roles claims.  It is sounding more and more like either I have a buggy version or I have some subtle misconfiguration somewhere in the custom sts I am not seeing.

I look forward to seeing your example to compare.

If there are any Telerik folks reading this here is some detail that may be useful to you:

Since yesterday I did discover that the 302 on DefaultWorkflows/PagesApprovalWorkflow.xamlx was resulting in a second session being started because it was redirecting to the sts and the provided sts code ALWAYS issues a new token id.  I corrected that and now the redirect to and back from the sts is fine, but when I return to the DefaultWorkflows/PagesApprovalWorkflow.xamlx.  Now it calls ~/Sitefinity/Services/Workflow/WorkflowService.svc and the cleint pops this error:

Description of my solution here:

http://www.sitefinity.com/devnet/forums/sitefinity/general-discussions/claims-based-auth-with-non-sitefinity-security-token-service.aspx#2194461

I think seeing your working example of security.config shows me something went wrong when I used the admin tools to edit the settings.  Looks promising so far.  I will update after some additional testing.

Thanks for the example regardless..

UPDATE:
It looks like the security config issue and something I had wrong in the role implementation were most of my issues.  That means I have even more work to do, but at least I think I am on the right track.  We have wasted weeks trying to do this off the developer docs and I pretty much just did a POC version from scratch in about 6 hours with David's examples.

This sort of detailed example is sorely needed in the Sitefinity 5 Docs.

Thanks again David.

I did a blog post today which might help you. I intend to blog about few advance scenarios as well in coming weeks. 

zamd.net/.../