title: WCF wsHttpBinding with Transport Security
body: <p><a href="http://msdn.microsoft.com/en-us/library/system.servicemodel.wshttpsecurity" rel="nofollow">Here</a> on MSDN as well as <a href="http://msdn.microsoft.com/en-us/library/ms734679.aspx" rel="nofollow">here</a> states the when dealing with <code>wsHttpBinding</code>, Transport security is handled via SSL. </p>
  
  <p>On the <a href="http://msdn.microsoft.com/en-us/library/ms734679.aspx" rel="nofollow">MSDN page about SSL and WCF</a> it states that when a ServiceHost is hosted within IIS, the ServiceHost leaves the SSL to be handled by IIS.</p>
  
  <p>Would this not imply that if <code>binding/securityMode="Transport"</code>, that any <code>wsHttpBinding/binding/security/transport/clientCredentialType</code> values would be ignored as none of their options are  needed to set up the SSL transport?</p>
  
  <p>It even appears to to say something to this effect <a href="http://msdn.microsoft.com/en-us/library/ms731884.aspx" rel="nofollow">here</a> when it states </p>
  
  <blockquote>
    <p>"When setting the security mode to TransportWithMessageCredential, the
    transport determines the actual mechanism that provides the
    transport-level security. For example, the HTTP protocol uses Secure
    Sockets Layer (SSL) over HTTP (HTTPS). Therefore, setting the
    ClientCredentialType property of any transport security object (such
    as HttpTransportSecurity) is ignored. In other words, you can only set
    the ClientCredentialType of the message security object (for the
    WSHttpBinding binding, the NonDualMessageSecurityOverHttp object)."</p>
  </blockquote>
  
  <p>And yet <a href="http://msdn.microsoft.com/en-us/library/ms734679.aspx" rel="nofollow">here</a> for <code>basicHttpBinding</code> and for <code>wsHttpBinding</code>, they both categorically emphasis with examples that if security mode is set to Transport, set the binding/transport/clientCredentialType to something (eg: Windows).</p>
  
  <p>What's the exact difference between <code>Transport</code> and <code>TransportWithMessageCredential</code>?</p>
  
  <p>And do I have the wrong end of the stick, and the <code>SecurityType</code> enum (<code>None|Message|Transport|Mixed</code>) is not just for privacy, but for authentication to the server? </p>
  
  <p>If Transport security is provided by SSL encryption, how did Authentication/Authorization get tangled into this stage?</p>
  
  <p>Thanks immensely for helping me get a better picture of how this all fits together.</p>