I am trying ot get a wcf service running with message level security and
username/pw client credentials. When I try to make a call on my proxy it
throws an exception on the client:

Inner Exception: "The request for security token has invalid or malformed
elements."

Outer: "Secure channel cannot be opened because security negotiation with
the remote endpoint has failed. This may be due to absent or incorrectly
specified EndpointIdentity in the EndpointAddress used to create the channel.
Please verify the EndpointIdentity specified or implied by the
EndpointAddress correctly identifies the remote endpoint."

I have self signed certificate installed and configured - not sure where to
look for the problem:

here is my service config file:
********************

<configuration>
<system.serviceModel>
<services>
<service name="ExtranetWebService.ExtranetService"
behaviorConfiguration="extranetServiceBehavior">
<endpoint contract="ExtranetWebService.IExtranetService"
binding="wsHttpBinding">
</endpoint>
<endpoint contract="IMetadataExchange" binding="mexHttpBinding"
address="mex" />
</service>
</services>

<behaviors>
<serviceBehaviors>
<behavior name="extranetServiceBehavior">
<serviceDebug includeExceptionDetailInFaults="true" />
<serviceMetadata httpGetEnabled="true"/>
<serviceAuthorization principalPermissionMode="Custom"/>
<serviceCredentials>
<userNameAuthentication userNamePasswordValidationMode="Custom"
customUserNamePasswordValidatorType="ExtranetWebService.CustomWCFUserNameValidator,ExtranetWebService"/>

<serviceCertificate findValue="XPS" storeLocation="LocalMachine"
storeName="My" x509FindType="FindBySubjectName" />
</serviceCredentials>
</behavior>
</serviceBehaviors>
</behaviors>
<bindings>
<wsHttpBinding>
<binding name="wsHttpBinding" maxReceivedMessageSize="2000000">
<security mode="Message">
<message clientCredentialType="UserName"/>
</security>
</binding>
</wsHttpBinding>
</bindings>
</system.serviceModel>

and my client config file:
******************

<system.serviceModel>
<bindings>
<wsHttpBinding>
<binding name="WSHttpBinding_IExtranetService"
maxReceivedMessageSize="2000000">
<security mode="Message">
<message clientCredentialType="UserName" negotiateServiceCredential="true"
establishSecurityContext="true" />
</security>
</binding>
</wsHttpBinding>
</bindings>
<client>
<endpoint address="http://localhost:80/ExtranetService"
behaviorConfiguration="ClientCertificateBehavior"
binding="wsHttpBinding"
bindingConfiguration="WSHttpBinding_IExtranetService"
contract="ExtranetExplorer.ExtranetService.IExtranetService"
name="WSHttpBinding_IExtranetService">
</endpoint>
</client>
<behaviors>
<endpointBehaviors>
<behavior name="ClientCertificateBehavior">
<clientCredentials>
<serviceCertificate>
<authentication certificateValidationMode="PeerOrChainTrust" />
</serviceCertificate>
</clientCredentials>
</behavior>
</endpointBehaviors>
</behaviors>
</system.serviceModel>

I also turned on tracing to get more detail and here is a snippet from that:
************************************

<Message>Incoming binary negotiation has invalid ValueType
http://schemas.xmlsoap.org/ws/2005/02/trust/tlsnego.</Message><StackTrace>
at
System.ServiceModel.Security.BinaryNegotiation.Validate(XmlDictionaryString
valueTypeUriDictionaryString)
at
System.ServiceModel.Security.SspiNegotiationTokenAuthenticator.ValidateIncomingBinaryNegotiation(BinaryNegotiation incomingNego)
at
System.ServiceModel.Security.SspiNegotiationTokenAuthenticator.ProcessRequestSecurityToken(Message
request, RequestSecurityToken requestSecurityToken,
SspiNegotiationTokenAuthenticatorState&amp; negotiationState)
at
System.ServiceModel.Security.NegotiationTokenAuthenticator`1.ProcessRequestCore(Message request)

and my custom username validator class:
**************************

namespace ExtranetWebService
{
/// <summary>
/// used to authenticate users against eDefine security framework
/// </summary>
class CustomWCFUserNameValidator : UserNamePasswordValidator
{
public override void Validate(string userName, string password)
{
if (userName == null || password == null)
{
throw new ArgumentNullException();
}

//check username and password
if(eDefine.Framework.Security.UserManager.Login(userName, password).Status
!= eDefine.Framework.Security.LoginStatus.Success)
{
throw new SecurityTokenException("ERROR: Unkown username or incorrect
password");
}
}
}
}