So a couple days ago I posted an entry about how to implement a custom transport that allows you to send message credentials over plain old HTTP. Unfortunately when I rolled this into the test environment where I had all the "real" infrastructure in place I ran into a new problem. It appears that the username token implementation built into WCF has some hardcoded logic for how it deals with addresses. I have filed a bug over on Microsoft Connect and I hope that Microsoft addresses it soon. Lately they haven't responded to a single post I've made about WCF problems in the forums including the original question about how to even solve the SSL passthrough problem. :(
The fact is, there's a workaround but it's completely unreasonable because none of Microsoft's own web service stacks (WSE, WCF, built in .NET) make it easy to change the address of the request. They just assumes that the wsa:To should be the URL that your connecting to... and technically this is right 99% of the time. The workaround for now is that I have to have my client connect to https, but change the actual wsa:To to be http. Does it work? Yes. Should I have to resort to that? No way. :\