Identity Model Claims With XML Characters Within Them

I'd like to do something like

 outputIdentity.Claims.Add(new Claim("Claim1", "<test>Hi</test>"))

However the security node within the response header itself shows it as

<Attribute Name="Claim1"><AttributeValue>&lt;test&gt;Hi&lt;/test&gt;</AttributeValue></Attribute>

I know they are reserved XML characters getting translated but can't I specify that I want that node stru开发者_如何学运维cture in my attribute?

NOTE: I've also tried wrapping it in CDATA however it serializes that tag too. When I replace the translated characters, it works.

---

Serialization of security tokens is done by the SecurityTokenHandler (in your case probably the Saml11SecurityTokenHandler).

If you want to customize serialization you have to overwrite the default behaviour by extending the Saml11SecurityTokenHandler class:

class CustomHandler : Saml11SecurityTokenHandler
{
    public Saml11SecurityTokenHandler()
      : base()
    {
    }

    public Saml11SecurityTokenHandler(SamlSecurityTokenRequirement samlSecurityTokenRequirement)
      : base(samlSecurityTokenRequirement)
    {
    }

    public Saml11SecurityTokenHandler(XmlNodeList customConfigElements)
      : base(customConfigElements)
    {
    }

    protected override void WriteAttribute(XmlWriter writer, SamlAttribute attribute)
    {
        // your code here
    }
}

You also have to add your custom security token handler in the web.config file:

<securityTokenHandlers>
  <add type="Your.Namespace.CustomHandler, Your.Dll.Name, Version=1.0.0.0, Culture=neutral" />
</securityTokenHandlers>

EDIT: removed <clear />

---

Can you try wrapping the value in CDATA section? As:

<![CDATA[<test>Hi</test>]]>

Not sure whether your SecurityTokenHandler class will handle that properly, but it's worth a try, and easier than introducing custom handlers.