I've tried this with net.tcp binding, but it still seems to be using windows authentication. The custom validator is never called and
OperationContext.Current.ServiceSecurityContext.PrimaryIdentity.Name
is the windows id of the caller rather than the username set with
ChannelFactory.Credentials.UserName.UserName
Is another step needed in the binding?