I have a webservice app with two endpoints in it:

Service.asmx
Secure/SecureService.asmx

I have setup my policy etc so that the SecureService.aspx endpoint requires
a username and password token and I have a Custom UsernameTokenManager that
authenticates the token (checks that the username exists and checks that the
passwords match).  All is well.

However, I now have a requirement that other Service.asmx endpoint should
require a username ONLY token (ie no password).  I have a policy file that
achieves this, however I wish to use a _different_ custom token manager that
will ONLY verify that the username exists.

I am finding it difficult (or is it even possible?) to get each service to
use it's own token manager.  I have a feeling that with some jiggery-pokery
with a web.config in the "Secure" subdirectory that I should be able to
achieve this, but I am finding that only one authenticator is ever called for
both endpoints.

Any help would be appreciated...

Pete