<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <startup>
        <supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.6.1"/>
    </startup>
  <system.serviceModel>
    <bindings>
      <wsHttpBinding>
        <binding name="TestAuthWCF.SecretServiceBinding">
          <!-- Укажем Security Mode -->
          <security mode="Message">
            <!-- Тип аутентификации -->
            <message clientCredentialType="UserName"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>
    <services>
      <service behaviorConfiguration="TestAuthWCF.SecretServiceBehavior"
        name="TestAuthWCF.TestAuthWCF">
        <endpoint address="http://localhost/service" binding="wsHttpBinding"
          bindingConfiguration="TestAuthWCF.SecretServiceBinding" contract="TestAuthWCF.ITestAuthWCF" />
        <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange" />
        <host>
          <baseAddresses>
            <add baseAddress="http://localhost/service" />
          </baseAddresses>
        </host>
      </service>
    </services>
    <behaviors>
      <serviceBehaviors>
        <behavior name="TestAuthWCF.SecretServiceBehavior">
          <serviceMetadata httpGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="true" />
          <serviceCredentials>
            <serviceCertificate findValue="Фамилия Имя Отчество" storeLocation="CurrentUser"
              x509FindType="FindBySubjectName" />
            <userNameAuthentication userNamePasswordValidationMode="Custom"
              customUserNamePasswordValidatorType="TestAuthWCF.CustomUserNameValidator, TestAuthWCF" />
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>
  </system.serviceModel>
</configuration>

public class CustomUserNameValidator : UserNamePasswordValidator
    {
        public override void Validate(string userName, string password)
        {
            // Доступ разрешен только пользователю "ilya" по паролю "pass"
            if (!(userName == "ilya" && password == "pass"))
            {
                throw new FaultException("Неверный логин или пароль");
            }
        }
    }