Hello,

I want to restrict access to an ASP.NET web service using a WS-Security
Username and password.  I'm *not* using SSL, ceretificates, Kerberos, Windows
accounts, or anything of the kind.  I simply want to 1) detect whether or not
the <wsse:UsernameToken> element is present.  If not, automatically reject
the request.  If so, check for an acceptable password.

To accomplish this, I've written a custom UsernameTokenManager, which looks
like this:

Imports Microsoft.VisualBasic
Imports Microsoft.Web.Services3.Security.Tokens

Namespace Brook

   Public Class MyUserNameTokenManager
       Inherits UsernameTokenManager
       Protected Overrides Function AuthenticateToken(ByVal token As
UsernameToken) As String
           Dim blah As String
           blah = ""
           If token.Username = "brook" Then
               blah = "monkey"
           End If
           Return blah
       End Function
   End Class

End Namespace

Furthermore, I have updated my web.config file with the following:

<security>
     <securityTokenManager>
       <add type="Brook.MyUserNameTokenManager"
namespace="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" localName="UsernameToken" qname="wsse:UsernameToken" />
     </securityTokenManager>
</security>

Now, the good news is that this works flawlessly- a client sending a request
to the service with an incorrect username/password is returned an error.  The
problem is that clients sending requests with *no* WS-Security information
(just a plain old SOAP message) are allowed through.  

How do I configure my service to reject messages that are missing the
<wsse:UsernameToken> security information in the soap header?  I'm thinking
the answer might be in the use of a policy file, but I haven't had any
success on this front.

Thanks

Brook