<bindings>
      <wsHttpBinding>
        <binding>
          <security mode="TransportWithMessageCredential">
            <transport clientCredentialType="None" />
            <message clientCredentialType="UserName" algorithmSuite="Default"/>
          </security>
        </binding>
      </wsHttpBinding>
    </bindings>

 <behaviors>
      <serviceBehaviors>
        <behavior name="UserNameAuthentication">
          <serviceCredentials>
            <userNameAuthentication
                userNamePasswordValidationMode="Custom"
                customUserNamePasswordValidatorType="Namespace.CredentialValidator, dllName"/>
          </serviceCredentials>
        </behavior>
      </serviceBehaviors>
    </behaviors>

public class CredentialValidator: UserNamePasswordValidator
    {
        public override void Validate(string userName, string password)
        {
            
        }
    }