wcf authentication with username and password - wcf

Question

It is "looks easy" task cant be done by myself. I have a WCF service which should be protected by username and password credential and stay in session mode.
So, here is the part of interface with Activation function.
<ServiceContract(SessionMode:=SessionMode.Required, ProtectionLevel:= ProtectionLevel.EncryptAndSign)>
Public Interface ServiceS
<OperationContract()>
Function Activation(A As String) As String
End Interface
Background Class
Public Class Service1
Implements ServiceS
Function Activation(A As String) As String Implement ServiceS.Activation
Return "Hello, " & A & "!"
End Function
End Class
Next is a web.config.
<services>
<service name="MyServiceS.Service1" behaviorConfiguration="MyBehavior">
<endpoint address="" binding="wsHttpBinding" bindingConfiguration="MyBinding" contract="MyServiceS.ServiceS" />
</service>
</services>
<bindings>
<wsHttpBinding>
<binding name="MyBinding" useDefaultWebProxy="false">
<security mode="Message" />
</binding>
</wsHttpBinding>
</bindings>
<behaviors>
<serviceBehaviors>
<behavior name="MyBehavior">
<serviceMetadata httpGetEnabled="true" httpsGetEnabled="true"/>
</behavior>
</serviceBehaviors>
</behaviors>
<protocolMapping>
<add scheme="https" binding="wsHttpBinding"/>
<add scheme="http" binding="wsHttpBinding"/>
</protocolMapping>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true"/>
</system.serviceModel>
Client side code.
Dim wcfTest As New MyService.ServiceSClient
wcfTest.ClientCredentials.Windows.ClientCredential.UserName = "Name"
wcfTest.ClientCredentials.Windows.ClientCredential.Password = "Password"
Dim Reply as String = wcfTest.Activation("Alex")
What do I expect? I need my WPF application connect to my service and pass username and password. If they are correct, user can access to Activation function, if not - session should be closed. So, I passed login and password to service but have no idea, how to check it. Should it be the part of interface or background class or else?
I saw tons of examples in Internet but most of them about other things.
Recommendation of using of ASP. I don't need ASP. This service should be pure WCF.
Using certificate. I don't need any certificates. It's should be only username and password verification.
Roles. No roles needed. Only username and password verification.
basicHttpBinding. No, only wsHttpBinding.
.Net 3.5 or 4.5. Many solutions addressed to .Net 3.5. I'm using 4.0 (used to use 4.5 but there new technology has been integrated and practically no complete examples).
If you know how to keep session by checking only username and password only with wsHttpBinding only with WCF only with 4.0, please, advice. Or say, why it's impossible if it so. Thaks alot!

Answer 1

You should first set the client credentialtype to UserName like below.
<wsHttpBinding>
<binding name="Binding1">
<security mode="Message">
<message clientCredentialType="UserName" />
</security>
</binding>
</wsHttpBinding>
Then you can implement a custom user name & password validator like in this article and implement authentication.