Hi Mark,

As for the usernameForCertificate Assertion, it will be responsible for
securing the username/password credential of the authentication service,
there is not need to add additional transport layer security(like
https/ssl). You need to use a secure transport layer when you are using
usernameOverTransport policy assertion, in such case, WSE (the assertion)
do nothing on the SOAP message's securing.

HOpe this helps.

Regards,

Steven Cheng
Microsoft Online Community Support

==================================================

When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.

==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.