I have a weird problem I am running into. I am using the
UsernameOverCertificate turnkey scenario with WSE 3.0. I am using a
CustomUsernameTokenManager class where I am overriding the AuthenticateToken
method so I can do custom authentication.

When I set the client to use a Policy file & intentionally provide a bad
password in the UsernameToken when calling the Web Service the authentication
does not fail as its supposed to. However, when I create the policy assertion
in code & turn off WSE Enable Policy it does work as thought - fails on bad
password & succeeds on good. My code creating the usernameovercertificate
assertion & the policy file are exactly similar.

Even on the WSE 3 QuickStarts, I can get the WSSecurityUsernameCode solution
to authenticate properly but not the WSSecurityUsernamePolicy solution to do
the same.

Any ideas?