Generating User Security Context from a SharePoint Online workflow Activity

Question

I have following SharePoint components--

1. A SharePoint online site with bunch of document libraries.
2. Deployed workflow custom actions using visual studio and sandbox solution.
3. Created provider hosted app with app web hosted on Azure web server.
4. Deployed one WCF service along with app web hosted on Azure web server. Web service is anonymous and can be called from anywhere.
5. I am calling WCF web service using SendHTTP activity from Visual studio custom action.
6. WCF tries to use S2SSecurityToken sent by SendHTTP activity and access host web by creating client context using tokenhelp class.

My problem starts now,

I cannot create access token using S2S security token. It gives me following exception --

System.IdentityModel.Tokens.SecurityTokenValidationException: The token being parsed does not have an issuer. 
   at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadTokenCore(String token, Boolean isActorToken) 
   at Microsoft.IdentityModel.S2S.Tokens.JsonWebSecurityTokenHandler.ReadToken(String token)

I have tried to create client context using username/password and SharePointOnlineCredentials class and it was successful.

But question is --

Is it possible to access host web list item from custom azure hosted wcf service using some sort of header token? I want to use current user's credential to access host web.

Sample code I have used within web service is --

WebHeaderCollection headers = WebOperationContext.Current.IncomingRequest.Headers;

string contextTokenSting = headers["S2SSecurityContext"];

SharePointContextToken contextToken = TokenHelper.ReadAndValidateContextToken(contextTokenSting, sharepointUrl.Authority);

string accessToken = TokenHelper.GetAccessToken(contextToken, sharepointUrl.Authority).AccessToken;

ClientContext clientContext = TokenHelper.GetClientContextWithAccessToken(sharepointUrl.ToString(), accessToken);

Web web = clientContext.Web;
File file = web.GetFileByServerRelativeUrl(serverrelative);
clientContext.Load(file);
clientContext.ExecuteQuery();

Answer 1

I made some progress in achieving this. I am now using the app only token ('SharePoint App' user) to access the SharePoint online site from my custom WCF service. I am using following code:

string realm = TokenHelper.GetRealmFromTargetUrl(sharepointUrl);

string accessToken = TokenHelper.GetAppOnlyAccessToken(TokenHelper.SharePointPrincipal, sharepointUrl.Authority, realm).AccessToken;

using (var clientContext = TokenHelper.GetClientContextWithAccessToken(sharepointUrl.ToString(), accessToken))
{
     //Do your operation 
}

It uses the tenant ID (realm) to create app only token. 'sharepointUrl' is my SharePoint online site url. Also, your app needs to have access to SharePoint site and WCF service should be in the remote app web site created with Provider hosted app.

It is still not my ideal implementation. I am looking to use current user context instead of default app user. But this should get me going until I find permanent solution.