title: WCF custom userName authentication using HTTP
body: <p>I am trying to configure my WCF service to use a custom username validator over HTTP and my ASP.NET Development server.   Following are the parts of the serviceModel...</p>
  
  <pre><code>&lt;basicHttpBinding&gt;
      &lt;binding name="Authentication" &gt;
        &lt;security mode="TransportCredentialOnly" &gt;
          &lt;message clientCredentialType="UserName"/&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
  &lt;/basicHttpBinding&gt;
  
    &lt;service behaviorConfiguration="ApiBehavior" name="CriticalWatch.AuthenticationAPI.AuthenticationAPI"&gt;
      &lt;endpoint address="/" binding="basicHttpBinding" bindingConfiguration="AuthenticationBinding" name="Authentication" contract="CriticalWatch.AuthenticationAPI.IAuthenticationAPI" /&gt;
    &lt;/service&gt;
  </code></pre>
  
  <p>I then have a behavior for the validator...</p>
  
  <pre><code>  &lt;serviceBehaviors&gt;
      &lt;behavior name="ApiBehavior"&gt;
        &lt;serviceMetadata httpGetEnabled="true" /&gt;
        &lt;serviceDebug includeExceptionDetailInFaults="true" /&gt;
        &lt;serviceCredentials&gt;
          &lt;userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Service.CustomUserNameValidator, MyService" /&gt;
        &lt;/serviceCredentials&gt;
  
      &lt;/behavior&gt;
    &lt;/serviceBehaviors&gt;
  </code></pre>
  
  <p>My CustomUserNameValidator inherits from the  UserNamePasswordValidator.  The validator class gets instantiated,  but the Validate method is never called.  Plus, the client can call the method without passing any username and password.</p>
  
  <p>What am I missing?</p>
  
  <p>At this time, I want a solution that does not require HTTPS.   I want to rely on the username and password passed with the message.</p>