Is root-tag <RequestSecurityTokenResponseCollection> really necessary?

[doeringp]

I opened this issue for discussion. Look at this TODO comment in code.

In my opinion wrapping the <RequestSecurityTokenResponse> in a <RequestSecurityTokenReponseCollection> isn't necessary.

The old sample IdentityServer/IdentityServer4.WsFederation running on .NET Framework, does not do it either.

I've tested it on SharePoint. It did work without the collection:

[doeringp]

ADFS also does not wrap the RequestSecurityTokenResponse in a collection.

[616b2f]

You are right we could omit it to be better compatible (more ADFS like). PR's are welcome :)