title: Securing a WCF WebService without using a certificate
body: <p>I have been trying to secure my WCF WebService correctly for a few days now, however I have now run into a roadblock. I am attempting to secure this WebService without the use of a certificate as this will run inside a secure intranet.</p>
  
  <p>I would like to be able to username/password protect the WebService without having to change each method to validate a username and password and without having to use a certificate. Is this possible:</p>
  
  <p>My current web.config is below:</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
   &lt;system.web&gt;
    &lt;compilation debug="true" targetFramework="4.0" /&gt;
   &lt;/system.web&gt;
   &lt;system.serviceModel&gt;
    &lt;services&gt;
     &lt;service name="TestWS.Service1" behaviorConfiguration="Default"&gt;
      &lt;endpoint contract="IMetadataExchange" binding="mexHttpBinding" address="mex" /&gt;
      &lt;endpoint contract="TestWS.IService1" binding="wsHttpBinding" bindingConfiguration="Binding1" address="" /&gt;
    &lt;/service&gt;
   &lt;/services&gt;
   &lt;bindings&gt;
    &lt;wsHttpBinding&gt;
      &lt;binding name="Binding1"&gt;
        &lt;security mode="Message"&gt;
         &lt;message clientCredentialType="UserName"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
    &lt;/wsHttpBinding&gt;
   &lt;/bindings&gt;
   &lt;behaviors&gt;
    &lt;serviceBehaviors&gt;
      &lt;behavior name="Default"&gt;
        &lt;!-- To avoid disclosing metadata information, set the value below to false and remove the metadata endpoint above before deployment --&gt;
        &lt;serviceMetadata httpGetEnabled="true"/&gt;
        &lt;serviceCredentials&gt;
          &lt;userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="TestWS.Validation.VanguardValidator, TestWS" /&gt;
        &lt;/serviceCredentials&gt;
        &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="false"/&gt;
      &lt;/behavior&gt;
     &lt;/serviceBehaviors&gt;
    &lt;/behaviors&gt;
    &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
   &lt;/system.serviceModel&gt;
   &lt;system.webServer&gt;
    &lt;modules runAllManagedModulesForAllRequests="true"/&gt;
   &lt;/system.webServer&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>Thanks in advance,</p>
  
  <p>Patrick</p>