namespace AuthenticateWCF
{
    public class CustomUserNameValidator : System.IdentityModel.Selectors.UserNamePasswordValidator
    {

        public override void Validate(string userName, string password)
        {
            if (userName == null && password == null)
                throw new ArgumentNullException();

            if (!(userName == "rrr" && password == "ppp"))
                throw new FaultException("incorrect password");


        }
    }
}

<system.serviceModel>
    <behaviors>
      <serviceBehaviors>
        <behavior>
          <serviceMetadata httpGetEnabled="true" httpsGetEnabled="false"/>
          <serviceDebug includeExceptionDetailInFaults="false"/>
          <serviceCredentials>
            <userNameAuthentication userNamePasswordValidationMode="Custom"
             customUserNamePasswordValidatorType="AuthenticateWCF.CustomUserNameValidator, AuthenticateWCF"/>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
    <bindings>
      <basicHttpBinding>
        <binding name="SecureBasic">
          <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName"/>
          </security>
      </binding>
      <binding name="wsHttp">
        <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName"  />
          </security>
      </binding>
      </basicHttpBinding>
    </bindings>
    <protocolMapping>
        <add binding="basicHttpBinding" scheme="http" />
    </protocolMapping>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
  </system.serviceModel>

ServiceReference1.Service1Client _client = new ServiceReference1.Service1Client();

            _client.ClientCredentials.UserName.UserName = "a";
            _client.ClientCredentials.UserName.Password = "bb";

            var result = _client.GetData(5);

<binding name="BasicHttpBinding_IService1" >
         <security mode="TransportWithMessageCredential">
            <message clientCredentialType="UserName"/>
          </security>
 </binding>