using System;

using System.IdentityModel.Selectors;

using System.IdentityModel.Tokens; 

namespace WcfService1

{

    public class ServiceAuthenticator : UserNamePasswordValidator

    {

        public override void Validate(string userName, string password)

            if (null == userName || null == password)

            {

                throw new ArgumentNullException();

            }

            if (!(userName == "username" && password == "password"))

            {

                throw new SecurityTokenException("Unknown Username or Password");

        }

    }

}

  <wsHttpBinding>

    <binding name="MyBinding">

      <security mode="Message">

        <message clientCredentialType="UserName"/>

      </security>

    </binding>

  </wsHttpBinding>

</bindings>

   <serviceBehaviors>

     <behavior name="MyBehavior">

       <serviceMetadata httpGetEnabled="true" />

       <serviceDebug includeExceptionDetailInFaults="true" />

       <serviceCredentials>

         <userNameAuthentication userNamePasswordValidationMode="Custom"

          customUserNamePasswordValidatorType="WcfService1.ServiceAuthenticator, WcfService1" /> 

         <serviceCertificate

           findValue="MyCertificate"

           x509FindType="FindBySubjectName"

           storeLocation="LocalMachine"

           storeName="My" />         

       </serviceCredentials>

     </behavior>

   </serviceBehaviors>

 </behaviors>

  <service behaviorConfiguration="MyBehavior" name="WcfService1.Service1">

    <endpoint address="Service1.svc" binding="wsHttpBinding"

              bindingConfiguration="MyBinding"

              contract="WcfService1.IService1" />

    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />

    <host>

      <baseAddresses>

        <add baseAddress="http://localhost:34435" />

      </baseAddresses>

    </host>

  </service>

</services>

using ConsoleApplication1.ServiceReference1;

using System.ServiceModel.Security; 

namespace ConsoleApplication1

{

    class Program

    {

        static void Main(string[] args)

        {

            try

            {

                Service1Client c = new Service1Client();

                c.ClientCredentials.UserName.UserName = "username";

                c.ClientCredentials.UserName.Password = "password";

                c.ClientCredentials.ServiceCertificate.Authentication.CertificateValidationMode = X509CertificateValidationMode.None;

                Console.WriteLine(c.GetData(5));

            }

            catch (MessageSecurityException ex)

            {

                Console.WriteLine(ex.Message);

            }

            Console.ReadLine();

    }

}