title: WCF security, username password without certificate
body: <p>I am new to <strong>WCF</strong>. I was used to *.asmx but it will become deprecated, so I decided to dive into WCF. I want a simple username + password authentication for my service, but everywhere on the web it's all about X509 certificates. I'd like to host my service in <strong>IIS</strong>, so I will enable <strong>SSL</strong> there. </p>
  
  <p>I have followed some hello world tutorials on WCF but am a bit confused with all the new things, datacontract, OperationContract, ServiceContract, required interfaces, all the bindings in <code>web.config</code>, basicHttpBinding etc.</p>
  
  <p>I am currently at <code>File -&gt; New project -&gt; Visual C# -&gt; WCF -&gt; WCF Service Application</code></p>
  
  <p>I have a kind of hello world app, and would like to know what the best and easiest way is to secure it. I have read so much different things that I just don't have a clue what is the best for my situation.</p>
  
  <p>The service hosted in IIS will be available on the internet (with ssl enabled) and the usernames and passwords i'd like to send out to several trusted people.</p>
  
  <p>Please advice me for the easiest and suitable security.</p>
  
  <p><strong>Edit</strong>
  I am trying to follow this blogpost:
  <a href="http://codebetter.com/petervanooijen/2010/03/22/a-simple-wcf-service-with-username-password-authentication-the-things-they-don-t-tell-you/" rel="nofollow noreferrer">http://codebetter.com/petervanooijen/2010/03/22/a-simple-wcf-service-with-username-password-authentication-the-things-they-don-t-tell-you/</a>
  but I have trouble with publishing the metadata. I assume that there is an error in my <code>web.config</code></p>
  
  <pre><code>&lt;system.serviceModel&gt;
      &lt;services&gt;
          &lt;service behaviorConfiguration="WcfServiceSimStars.MyServiceTypeBehaviors" name="FarmService.CustomerDeskOperations"&gt;
              &lt;endpoint address="" binding="wsHttpBinding" bindingConfiguration="RequestUserName" contract="WcfServiceSimStars.ISimService" /&gt;
              &lt;endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/&gt; 
          &lt;/service&gt;
      &lt;/services&gt;
      &lt;bindings&gt;
          &lt;wsHttpBinding&gt;
              &lt;binding name="RequestUserName" &gt;
                  &lt;security mode="Message"&gt;
                      &lt;message clientCredentialType="UserName"/&gt;
                  &lt;/security&gt;
              &lt;/binding&gt;
          &lt;/wsHttpBinding&gt;
      &lt;/bindings&gt;
      &lt;client&gt;
          &lt;endpoint address="http://mytestserver/simservice.svc" binding="WSHttpBinding"
              bindingConfiguration="WSHttpBinding_ISimService" contract="WcfServiceSimStars.ISimService"
              name="WSHttpBinding_ISimService" /&gt;
      &lt;/client&gt;
      &lt;behaviors&gt;
          &lt;serviceBehaviors&gt;
              &lt;behavior name="WcfServiceSimStars.MyServiceTypeBehaviors"&gt;
                  &lt;serviceMetadata httpGetEnabled="true"/&gt;
                  &lt;serviceCredentials&gt;
                      &lt;userNameAuthentication userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="WcfServiceSimStars.UserValidatorr, WcfServiceSimStars" /&gt;
                      &lt;serviceCertificate findValue="Farm" storeLocation="LocalMachine" storeName="TrustedPeople" x509FindType="FindBySubjectName" /&gt;
                  &lt;/serviceCredentials&gt;
              &lt;/behavior&gt;
          &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;serviceHostingEnvironment multipleSiteBindingsEnabled="true" /&gt;
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>and my solution explorer:</p>
  
  <p><img src="https://i.stack.imgur.com/orTxH.jpg" alt="solution explorer"></p>
  
  <p><strong>Edit 2:</strong>
  I tried to open my web.config with the <code>Microsoft Service Configuration Editor</code> from visual studio tools menu and got this error: </p>
  
  <p><img src="https://i.stack.imgur.com/WdLy9.jpg" alt="Microsoft Service Configuration Editor"></p>