Hi,

After readfing the Web Security Guide, I tried to implement ditrect
authentication using a UsernameToken by implementing the
usernameForCertificateSecurity policy.
I have a web application client which communicates with a service. I have a
login page where the client need to provides it's credentials.

My question is - should I use the usernameForCertificateSecurity policy all
over my web application when calling the service?
I want to maintain the authetication of the client who's calling the
service, and if  I understood correctly, when using
usernameForCertificateSecurity, I authenticate the client using it's
credentials and after I authethenticate the client, a derieved key is created
and each call to the service is authenticated using this derived key.

Thanks

Yoav