title: Authentication using HTTP Authorization Header in WCF SOAP API
body: <p>We currently have a WCF SOAP API that allows the consumer to authenticate using a username and password (internally uses a <a href="http://msdn.microsoft.com/en-us/library/system.identitymodel.selectors.usernamepasswordvalidator.aspx" rel="nofollow noreferrer">UserNamePasswordValidator</a>) For reference the username and password is passed in the SOAP Body as follows:</p>
  <pre><code>&lt;o:Security xmlns:o=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd&quot; mustUnderstand=&quot;1&quot;&gt;
  &lt;Timestamp Id=&quot;_0&quot;&gt;
      &lt;Created&gt;
          2013-04-05T16:35:07.341Z&lt;/Created&gt;
          &lt;Expires&gt;2013-04-05T16:40:07.341Z&lt;/Expires&gt;
      &lt;/Timestamp&gt;
      &lt;o:UsernameToken Id=&quot;uuid-ac5ffd20-8137-4524-8ea9-3f4f55c0274c-12&quot;&gt;
          &lt;o:Username&gt;someusername&lt;/o:Username&gt;
          &lt;o:Password o:Type=&quot;http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-username-token-profile-1.0#PasswordText&quot;&gt;somepassword
      &lt;/o:Password&gt;
  &lt;/o:UsernameToken&gt;
  &lt;/o:Security&gt;
  </code></pre>
  <p>We we like to <strong>additionally</strong> support a consumer to specify credentials in the <a href="http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.8" rel="nofollow noreferrer">HTTP Authorization header</a>, as either Basic auth, or an <a href="https://datatracker.ietf.org/doc/html/draft-ietf-oauth-v2-bearer-15#section-2.1" rel="nofollow noreferrer">OAuth Bearer token</a></p>
  <p>We already have several ways of actually doing the authentication for non-SOAP APIs, but I am not familiar with how to tell WCF to use any class I might create for this.  How can I accomplish this?  The only other question I have seen that attempts to answer this is <a href="https://stackoverflow.com/questions/2074361/wcf-with-http-basic-authentication">here</a>, but the accepted answer uses SOAP headers, not HTTP headers, and the asker essentially gave up.</p>
  <p>Obviously any solution needs to be backwards compatible - we need to continue to support consumers specifying credentials in the SOAP Security Header.</p>