// 服务端配置
public class CustomUserNameValidator : UserNamePasswordValidator
{
    public override void Validate(string userName, string password)
    {
        // 验证逻辑
        if (!ValidateUser(userName, password))
            throw new FaultException("无效的用户名或密码");
    }
}

// 在服务行为中配置
<behaviors>
  <serviceBehaviors>
    <behavior name="SecureBehavior">
      <serviceCredentials>
        <userNameAuthentication userNamePasswordValidationMode="Custom"
          customUserNamePasswordValidatorType="Namespace.CustomUserNameValidator, Assembly"/>
      </serviceCredentials>
    </behavior>
  </serviceBehaviors>
</behaviors>

// 使用OAuthAuthorizationServerMiddleware
app.UseOAuthAuthorizationServer(new OAuthAuthorizationServerOptions
{
    TokenEndpointPath = new PathString("/token"),
    Provider = new CustomOAuthProvider(),
    AccessTokenExpireTimeSpan = TimeSpan.FromMinutes(30),
    AllowInsecureHttp = false // 生产环境应为false
});

<bindings>
  <basicHttpBinding>
    <binding name="WindowsAuth">
      <security mode="TransportCredentialOnly">
        <transport clientCredentialType="Windows" />
      </security>
    </binding>
  </basicHttpBinding>
</bindings>

// 启用CORS
var cors = new EnableCorsAttribute("*", "*", "*");
config.EnableCors(cors);