title: Basic Authentication for WCF
body: <p>I am trying to do a very basic but secure username/password authentication with wcf.</p>
  
  <p>However when I look at the value of the <code>ServiceSecurityContext.Current.PrimaryIdentity;</code> it contains the credentials of my windows machine and claims it is authorised (even though I have not yet done any authorisation) instead of the username and password I provided to the service.</p>
  
  <p>My web.config of the service is as follows</p>
  
  <pre><code>&lt;?xml version="1.0"?&gt;
  &lt;configuration&gt;
  
    &lt;appSettings&gt;
      &lt;add key="aspnet:UseTaskFriendlySynchronizationContext" value="true" /&gt;
    &lt;/appSettings&gt;
    &lt;system.web&gt;
      &lt;compilation debug="true" targetFramework="4.5" /&gt;
      &lt;httpRuntime targetFramework="4.5"/&gt;
    &lt;/system.web&gt;
    &lt;system.serviceModel&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior&gt;
            &lt;!-- To avoid disclosing metadata information, set the values below to false before deployment --&gt;
            &lt;serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/&gt;
            &lt;!-- To receive exception details in faults for debugging purposes, set the value below to true.  Set to false before deployment to avoid disclosing exception information --&gt;
            &lt;serviceDebug includeExceptionDetailInFaults="true"/&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
      &lt;bindings&gt;
        &lt;wsHttpBinding&gt;
          &lt;binding name="WsHttpBindingConfig"&gt;
            &lt;security mode="TransportWithMessageCredential"&gt;
              &lt;transport clientCredentialType="None" /&gt;
              &lt;message clientCredentialType="UserName" /&gt;
            &lt;/security&gt;
          &lt;/binding&gt;
        &lt;/wsHttpBinding&gt;
  
      &lt;/bindings&gt;
      &lt;protocolMapping&gt;
          &lt;add binding="wsHttpBinding" scheme="http" /&gt;
      &lt;/protocolMapping&gt;    
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" /&gt;
    &lt;/system.serviceModel&gt;
    &lt;system.webServer&gt;
      &lt;modules runAllManagedModulesForAllRequests="true"/&gt;
      &lt;!--
          To browse web app root directory during debugging, set the value below to true.
          Set to false before deployment to avoid disclosing web app folder information.
        --&gt;
      &lt;directoryBrowse enabled="true"/&gt;
    &lt;/system.webServer&gt;
  
  &lt;/configuration&gt;
  </code></pre>
  
  <p>and the app.config of the client app is as follows</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="utf-8" ?&gt;
  &lt;configuration&gt;
      &lt;startup&gt; 
          &lt;supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" /&gt;
      &lt;/startup&gt;
      &lt;system.serviceModel&gt;
          &lt;bindings&gt;
              &lt;wsHttpBinding&gt;
                  &lt;binding name="WSHttpBinding_IService1" /&gt;
              &lt;/wsHttpBinding&gt;
          &lt;/bindings&gt;
          &lt;client&gt;
              &lt;endpoint address="http://localhost/WcfSecuredService/Service1.svc"
                  binding="wsHttpBinding" bindingConfiguration="WSHttpBinding_IService1"
                  contract="ServiceReference1.IService1" name="WSHttpBinding_IService1"&gt;
              &lt;/endpoint&gt;
          &lt;/client&gt;
      &lt;/system.serviceModel&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>I call the service with the following code</p>
  
  <pre><code>ServiceReference1.Service1Client clnt = new ServiceReference1.Service1Client();
              clnt.ClientCredentials.UserName.UserName = "peter";
              clnt.ClientCredentials.UserName.Password = "grr";
  
              string result=clnt.GetSecuredData();
  </code></pre>
  
  <p>What am I doing wrong?</p>
  
  <p>Please note that both the client app and the service are both running on the same machine. I do not know if the identity is that of the machine running the service or the one passed to it from the client as they are both the same credentials.....</p>
  
  <p>I suppose the other question is possibly "How do I get the username and password that were passed to the service?"</p>