WCF BasicHttpBinding + UserNamePasswordValidator+x.509

Question

I set up a WCF service for a client using wsHttpBinding with custom username validation, x.509, but NO SSL

They are using PHP and are completely unable to get past the WS security, so our solution must be to add another basichttpbinding. But when I do this, it seems like it is requiring SSL. My requirement is absolutely to NOT use SSL.

My wshttpbinding that works looks like this:

<wsHttpBinding>
    <binding name="WSHttpBinding_ISearchService" closeTimeout="00:10:00" openTimeout="00:01:00" receiveTimeout="00:10:00" sendTimeout="00:10:00" bypassProxyOnLocal="true" transactionFlow="false" hostNameComparisonMode="StrongWildcard" maxBufferPoolSize="2147483647" maxReceivedMessageSize="2147483647" messageEncoding="Text" textEncoding="utf-8" useDefaultWebProxy="true" allowCookies="false">
      <readerQuotas maxDepth="2147483647" maxStringContentLength="2147483647" maxArrayLength="2147483647" maxBytesPerRead="2147483647" maxNameTableCharCount="2147483647" />
      <reliableSession ordered="true" inactivityTimeout="00:10:00" enabled="false" />
      <security mode="Message"  >
        <message clientCredentialType="UserName"/>
      </security>
    </binding>

<serviceBehaviors>
    <behavior name="My.Services.SearchServiceBehavior">
      <serviceMetadata httpGetEnabled="true" />
      <serviceDebug includeExceptionDetailInFaults="true" />

      <dataContractSerializer maxItemsInObjectGraph="2147483647" />

      <serviceCredentials>
        <serviceCertificate findValue="01000000000xxxxxxxxx" storeLocation="LocalMachine"
                                 storeName="My" x509FindType="FindBySerialNumber" />
        <userNameAuthentication userNamePasswordValidationMode="Custom"
         customUserNamePasswordValidatorType="My.Services.UserNamePassValidator, SearchService" />
      </serviceCredentials>

    </behavior>
  </serviceBehaviors>

Is this same exact configuration possible using basichttpbinding without SSL?

Answer 1

BasicHttpBinding requires that BasicHttpBinding.Security.Message.ClientCredentialType be equivalent to the BasicHttpMessageCredentialType.Certificate credential type for security mode "Message". So first thing you cannot use clientCredentialType="UserName".
You need to have client certificate to encrypt the message and transfer. WCF SDK samples implement one such scenario, check here