title: Easiest method to use a client-generated token for WCF authentication
body: <p>(I tried searching, but couldn't find any truly helpful links.)</p>
  
  <p>We are implementing a set of WCF services. What I would <em>like</em> to do in these services is have the clients (which will be trusted application servers) be able to pass a token of some sort to the web service to authenticate. I <strong>do not</strong> want to be required to pass username/password on the initial or subsequent requests (because in some cases the calling application server may not have the password). Windows and Kerberos are not usable in our specific circumstance.</p>
  
  <p>I had thought to just create a simple custom UserNameSecurityTokenAuthenticator class and modify it so that if the password is empty, it takes userName as the string-encoded token value (obviously checking the token itself to verify that it's valid at that point), but if the password is not empty, forwarding on the username/password to a MembershipProvider for checking. Basically I'd like to overload the username/password authentication to provide for token passing as well.</p>
  
  <p>Is this possible? Can I simply plug in a token authenticator like this, or is there some other simple way to "intercept" requests like this (and update the actual username value from the decrypted token)?</p>
  
  <p>Or is there some other incredibly simple way to allow the client to pass a custom token and have the server accept it that I'm just missing?</p>