Here is the complete file.  It is the UsernameSigningCode example.

What I did in the meantime is to SHA1CryptoServiceProvider the password in
the client, Convert.ToBase64String, and then send it to the Service using
PasswordOption.SendPlainText in the UsernameToken.  I then
Convert.FromBase64String the plain (encrypted) text in the Service and
compare it with the password which is stored as SHA1CryptoServiceProvider in
the Database.

This seems to work and even I use PlainText option, I don't send the actual
password.  ALthough I still could not get it to use my
CustomeUsernameTokenManager....

/*================================================================================
 File:      UsernameTokenManager.cs

 Summary:   This is a sample which allows the user to send a message to a Web
            service that has been signed with a username and password
----------------------------------------------------------------------------------
This file is part of the Web Services Enhancements 2.0 for Microsoft .NET
Samples.

Copyright (C) Microsoft Corporation.  All rights reserved.

This source code is intended only as a supplement to Microsoft Development
Tools
and/or on-line documentation.  See these other materials for detailed
information
regarding Microsoft code samples.

This sample is designed to demonstrate WSE features and is not intended
for production use. Code and policy for a production application must be
developed to meet the specific data and security requirements of the
application.

THIS CODE AND INFORMATION ARE PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE IMPLIED
WARRANTIES
OF MERCHANTABILITY AND/OR FITNESS FOR A PARTICULAR PURPOSE
================================================================================*/

using System;
using System.Xml;
using System.Security.Permissions;

using Microsoft.Web.Services2.Security;
using Microsoft.Web.Services2.Security.Tokens;

namespace UsernameSignCodeService
{
   /// <summary>
   /// By implementing UsernameTokenManager we can verify the signature
   /// on messages received.
   /// </summary>
   /// <remarks>
   /// This class includes this demand to ensure that any untrusted
   /// assemblies cannot invoke this code. This helps mitigate
   /// brute-force discovery attacks.
   /// </remarks>
   [SecurityPermissionAttribute(SecurityAction.Demand,
Flags=SecurityPermissionFlag.UnmanagedCode)]
   public class CustomUsernameTokenManager : UsernameTokenManager
   {
       /// <summary>
       /// Constructs an instance of this security token manager.
       /// </summary>
       public CustomUsernameTokenManager()
       {
       }

       /// <summary>
       /// Constructs an instance of this security token manager.
       /// </summary>
       /// <param name="nodes">An XmlNodeList containing XML elements from
a configuration file.</param>
       public CustomUsernameTokenManager(XmlNodeList nodes)
           : base(nodes)
       {
       }

       /// <summary>
       /// Returns the password or password equivalent for the username
provided.
       /// </summary>
       /// <param name="token">The username token</param>
       /// <returns>The password (or password equivalent) for the
username</returns>
       protected override string AuthenticateToken( UsernameToken token )
       {
           // This is a very simple manager.
           // In most production systems the following code
           // typically consults an external database of
(username,password) pairs where
           // the password is often not the real password but a password
equivalent
           // (for example, the hash of the password). Provided that both
client and
           // server can generate the same value for a particular username,
there is
           // no requirement that the password be the actual password for
the user.
           // For this sample the password is simply the reverse of the
username.
           byte[] password = System.Text.Encoding.UTF8.GetBytes(
token.Username );

           Array.Reverse( password );

           return Convert.ToBase64String( password );
       }
   }
}