title: WCF Service Binding using allowInsecureTransport=true causes Update Service Reference in Client to fail
body: <p>This is my service configuration in web.config:</p>
  
  <pre><code>&lt;binding name="statefulSessionWithUsernameOverTransport"&gt;
    &lt;security authenticationMode="SecureConversation"
      requireSecurityContextCancellation="False" allowInsecureTransport="True"&gt;
      &lt;secureConversationBootstrap authenticationMode="UserNameOverTransport"/&gt;
    &lt;/security&gt;
    &lt;binaryMessageEncoding /&gt;
    &lt;httpTransport /&gt;
  &lt;/binding&gt;
  
  &lt;service name="com.example.FooService"
    behaviorConfiguration="usernamePasswordAuthBehavior"&gt;
    &lt;endpoint contract="com.example.FooService.IFooService"
      address="custom" binding="customBinding"
      bindingConfiguration="statefulSessionWithUsernameOverTransport" /&gt;
  &lt;/service&gt;
  </code></pre>
  
  <p>I am setting allowInsecureTransport=True because in Production the Service will be running behind an SSL Terminating Load Balancer. Calling the Service from my .Net 4.0 Client works without any problems but trying to update the service reference in VS2010 always results in an error:</p>
  
  <blockquote>
    <p>System.ServiceModel.Channels.TransportSecurityBindingElement
    Error: Security Policy Export failed. The Binding contains a TransportSecurityBindingElement but no transport security binding element that implements ITransportTokenAssertionProvider. Policy export for such a policy export is not supported.*</p>
  </blockquote>
  
  <p>I understand what it is trying to tell me - which is basically that I've disabled transport security on a binding that requires it to avoid compromising the credentials travelling over the wire. But - that is the whole point of <strong>allowInsecureTransport</strong>. Could it be that the proxy generator is simply not aware of this attribute?</p>
  
  <p><strong>Update:</strong></p>
  
  <p>It looks like the wsdl generator is indeed unable to deal with the attribute. I had to go back to Message Level Security and a Self-Signed Certificate for development. Using Message Security had the advantage of being able to stick to Cassini for Development instead of going full blown IIS.</p>
  
  <pre><code>&lt;wsHttpBinding&gt;
      &lt;binding name="wshttpDevelopmentBinding"&gt;
        &lt;security mode="Message"&gt;
          &lt;message clientCredentialType="UserName" /&gt;
        &lt;/security&gt;
      &lt;/binding&gt;
  &lt;/wsHttpBinding&gt;
  </code></pre>