William,

[WilliamT] I am not sure if you are using the UT in the context of the
SecurityTokenServiceClient. I think the statement above by Keith is wrt to
the SecurityTokenServiceClient. I quote:
The SecurityTokenServiceClient class will now automatically encrypt any
Username tokens included in a request. Similarly, the SecurityTokenService
class will automatically encrypt any username tokens included in a response.
Unless I am missing something as well, I dont think it forces a UNT
encryption if you are sending plain UNT as authentication credentials

The following methods have been added to the token issuing framework:
protected virtual void
SecurityTokenServiceClient.EnforceRequestUsernameTokenEncryption().
Called from EnforceRequestPolicy(), this method enforces the requirement
that any Username tokens in an RST message must be encrypted. The
issuerToken is used as the encrypting token. This method will throw an
exception if it cannot encrypt the UsernameTokens in an RST message.
Override this method to suppress this behavior.

protected virtual void
SecurityTokenService.VerifyRequestUsernameTokenEncryption().
Called from VerifyRequestPolicy(), this method verifies that tokens in an
RST message are encrypted. This method will throw an exception if it
encounters an unencrypted UsernameToken in an RST message.
Override this method to suppress this test.

protected virtual void
SecurityTokenService.EnforceResponseUsernameTokenEncryption().
Called from EnforceResponsePolicy(), this method enforces the requirement
that any Username tokens in an RSTR message must be encrypted. The
ResponseEncryptingToken is used as the encrypting token. This method will
throw an exception if it cannot encrypt the UsernameTokens in an RSTR
message.
Override this method to suppress this behavior.

protected virtual void
SecurityTokenServiceClient.VerifyResponseUsernameTokenEncryption().
Called from VerifyResponsePolicy(), this method verifies that tokens in an
RSTR message are encrypted. This method will throw an exception if it
encounters an unencrypted UsernameToken in an RSTR message.
Override this method to suppress this test.

http://spaces.msn.com/members/staceyw/Blog/cns!1pnsZpX0fPvDxLKC6rAAhLsQ!303.entry

Interesting article, thanks. Need to work my way trough it (and all previous
ones...), but basically you're using a key file made with the StrongName
tool? Good idea...

I meant actually that we need to keep track of logins for "auditing" and
it's not a public web service either. So, we need some authentication
mechanism. Some customers might be able to use Kerberos or X.509, but most
won't. (this is for development of a commercial product)