Drive a WS-Trust 1.4 exchange against a Security Token Service (STS). Build a SOAP RequestSecurityToken (RST) for the Issue, Renew, Validate, or Cancel operation, authenticate with a WS-Security UsernameToken or a SAML token, optionally sign and/or encrypt the request, add WS-Addressing headers, and send it. The STS RequestSecurityTokenResponse (RSTR) is shown on the WS-Trust Response page.
This is the static (backend-less) deployment. There is no API proxy, so the STS call must be made directly from the browser (the backend routing option is disabled below). A cross-origin SOAP STS commonly blocks direct browser calls (CORS); an STS that returns permissive CORS headers, or one on the same origin, is required here. Building, signing, and encrypting the request all run entirely in the browser.
