Hi Henrik,

Welcome to Webservice newsgroup.
As for the UsernameOverTransport Security Assertion,  addition to apply the
policy on our webservice, we also need to specify the authroization setting
in the policy. For example, we need to deny all the anonymous users so that
the client caller must provide UsernameToken  (bydefault the serverside
will authenticate the username token against the windows security authority
(need clear Text password...)

Here is an example policy file which using UsernameOverTransport assertion
and deny all anonymous clients:

======================
<policies xmlns="http://schemas.microsoft.com/wse/2005/06/policy">
 <extensions>
   <extension name="usernameOverTransportSecurity"
type="Microsoft.Web.Services3.Design.UsernameOverTransportAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="requireActionHeader"
type="Microsoft.Web.Services3.Design.RequireActionHeaderAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
   <extension name="authorization"
type="Microsoft.Web.Services3.Design.AuthorizationAssertion,
Microsoft.Web.Services3, Version=3.0.0.0, Culture=neutral,
PublicKeyToken=31bf3856ad364e35" />
 </extensions>
 <policy name="ServicePolicy">
   <authorization>
     <allow role="VS2005TeamSuite\WSEGroup" />
     <deny user="*" />
   </authorization>
   <usernameOverTransportSecurity />
   <requireActionHeader />
 </policy>
</policies>
==========================

Hope helps. Thanks,

Steven Cheng
Microsoft Online Support