c# - Keep MEX binding insecure while securing HTTP binding w/ UsernamePasswordValidator? -

After

We are using Username PasswordValidator with a certificate to secure access to our WCF services.

However, the custom authorization policies we are using are SERVICE behaviors, not endpoint behavior, so they apply to all end points, including the MEX endpoint. Want to be able to obtain and receive service references using Visual Studio without commenting, but since both Mex and wshttp endpoint are secure, then we "Add Service Service" .. "

Is there any way around this?

Is it binding on both of you? If so, try 2 separate bindings - one for MEX endpoint and one for wshttp:

For service - something like this:

  & lt; wsHttpBinding & gt; Binding name = "wsHttpBindingMessageUname" & gt; Security mode = "Message" & gt; Message client CredentialType = "UserName" chat serviceCredential = "True" install securitycontax = "false" />  gt; & lt; / force Kari & gt; & lt; / wsHttpBinding & gt;  

and for Max Endpoint (no security):

  & lt; Custom binding & gt; & Lt; Binding name = "custom max" & gt; & Lt; TextMessageEncoding & gt; & Lt; Readerkots Mksdepth = "2147483647" Mgstringkantentlength = "2147483647" Msrrylength = "2147483647" Maksbitsperread = "2147483647" Mksonmetablecrsunt = "2147483647" / & gt; & Lt; / TextMessageEncoding & gt; & Lt; HttpTransport transferMode = "buffer" maxReceivedMessageSize = "2147483647" maxBufferSize = "2147483647" /> & Lt; / Binding & gt; & Lt; / CustomBinding & gt;  

The service will be like a stop-point:

  & lt; Endpoint address = "" behaviorConfiguration = "Server.Services.DefaultEndpointBehavior" binding = "wsHttpBinding" bindingConfiguration = "WsHttpBindingMessageUname" name = "DefaultHttp" contract = "server.im services.imi service" URID = "clear" /> & lt; Endpoint address = "MEX" binding = "customBinding" contract = "IMetadataExchange" name = "" bindingConfiguration = "customMex" listenUriMode = "clear" />  

With this setup, it is not implementing the safety of mex, so to update the service reference, you should not receive that message. Either, or create another secure binding that uses different credentials, that is, the client certificate on your machine.

The following post has a sample of it and more secure information can be found in this regard. / P>