title: WCF Authentication - TransportCredentialOnly with ASPNET Membership
body: <p>I feel like I'm close but I'm a newbie at WCF and can't figure out why this is not working.  I've tried searching, but I couldn't find an example of using aspnet membership without using message level security.  I am trying to authenticate over https from Android to a WCF service.  It works just fine until I change the clientCredentialType from 'None' to 'Basic'.  I have to authenticate via username and password. When I try to update my proxy by running slsvcutil.exe against the <code>https://myPublicWebsite/ABCService/ABC.svc</code> it gives the following error:</p>
  
  <blockquote>
    <p>The authentication schemes configured on the host ('IntegratedWindowsAuthentication, Anonymous') do not allow those configured on the binding 'BasicHttpBinding' ('Basic').  Please ensure that the SecurityMode is set to Transport or TransportCredentialOnly.  Additionally, this may be resolved by changing the authentication schemes for this application through the IIS management tool, through the ServiceHost.Authentication.AuthenticationSchemes property, in the application configuration file at the  element, by updating the ClientCredentialType property on the binding, or by adjusting the AuthenticationScheme property on the HttpTransportBindingElement.</p>
  </blockquote>
  
  <p>Here is my web.config of the service.  Thanks for any help you can give me.</p>
  
  <pre><code>    &lt;system.web&gt;
      &lt;compilation debug="false" strict="false" explicit="true" targetFramework="4.0" /&gt;
      &lt;customErrors mode="Off" /&gt;
  
      &lt;membership defaultProvider="AspNetSqlMembershipProvider" userIsOnlineTimeWindow="15"&gt;
        &lt;providers&gt;
          &lt;remove name="AspNetSqlMembershipProvider" /&gt;
          &lt;clear /&gt;
          &lt;add
            name="AspNetSqlMembershipProvider"
            type="System.Web.Security.SqlMembershipProvider"
            connectionStringName="LocalSqlServer"
            applicationName="ABC"
            enablePasswordRetrieval="false"
            enablePasswordReset="false"
            requiresQuestionAndAnswer="false"
            minRequiredPasswordLength="8"
            requiresUniqueEmail="true"
            passwordFormat="Hashed" /&gt;
        &lt;/providers&gt;
      &lt;/membership&gt;
    &lt;/system.web&gt;
  
    &lt;system.serviceModel&gt;
      &lt;services&gt;
        &lt;service name="ABCService.ABC" behaviorConfiguration="metadataBehavior"&gt;
          &lt;endpoint
              address=""
              binding="basicHttpBinding"
              bindingConfiguration="ABCBinding"
              contract="ABCService.IService1"/&gt;
        &lt;/service&gt;
      &lt;/services&gt;
  
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="metadataBehavior"&gt;
            &lt;serviceMetadata httpGetEnabled="false" httpsGetEnabled="true"/&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="false"/&gt;
            &lt;serviceCredentials&gt;
              &lt;userNameAuthentication
              userNamePasswordValidationMode="MembershipProvider"
              membershipProviderName="AspNetSqlMembershipProvider" /&gt;
            &lt;/serviceCredentials&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
  
      &lt;bindings&gt;
        &lt;basicHttpBinding&gt;
          &lt;binding name="ABCBinding"&gt;
            &lt;security mode="TransportCredentialOnly"&gt;
              &lt;transport clientCredentialType="Basic" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/basicHttpBinding&gt;
      &lt;/bindings&gt;
  
      &lt;protocolMapping&gt;
        &lt;add binding="basicHttpsBinding" scheme="https"/&gt;
      &lt;/protocolMapping&gt;
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true"/&gt;
    &lt;/system.serviceModel&gt;
    &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"/&gt;    
      &lt;directoryBrowse enabled="false"/&gt;
    &lt;/system.webServer&gt;
  </code></pre>
  
  <p>Also, what do I put in the code of service to run the validation check?  I have this:</p>
  
  <pre><code>Public Class MyCustomUserNameValidator
      Inherits IdentityModel.Selectors.UserNamePasswordValidator
  
      ' This method validates users. It allows two users, test1 and test2  
      ' with passwords 1tset and 2tset respectively. 
      ' This code is for illustration purposes only and  
      ' MUST NOT be used in a production environment because it is NOT secure.     
      Public Overrides Sub Validate(ByVal userName As String, ByVal password As String)
          If Nothing = userName OrElse Nothing = password Then
              Throw New ArgumentNullException()
          End If
  
          If Not (userName = "test1" AndAlso password = "1tset") AndAlso Not (userName = "test2" AndAlso password = "2tset") Then
              Throw New IdentityModel.Tokens.SecurityTokenException("Unknown Username or Password")
          End If
  
      End Sub
  End Class
  </code></pre>
  
  <p>But I don't really understand how it works because I never call it, and I would rather use a default one than a custom one.  I'm sure this is simple, but all the examples I could find by searching are for 'custom' validators.  Does this get called automatically? or do I even need it if I just want the default? </p>