Are there more customUserNamePasswordValidatorType instances?

Question

Is there only one instance of customUserNamePasswordValidatorType or is it possible that there are more than one instance per "application"?
If there are more instances, is somewhere written the logic, when they are created (e.g. one instance per login, per hour or something else)?

Answer 1

As far as I know, there exists only one instance of customUserNamePasswordValidatorType. Regardless of the way that the WCF application runs, single instance or multiple instances there is always one instance of validation logic for everyone consuming the service.

using (WebServiceHost sh = new WebServiceHost(typeof(MyService), uri))
{
    sh.AddServiceEndpoint(typeof(IService), binding, "");
    ServiceMetadataBehavior smb;
    smb = sh.Description.Behaviors.Find<ServiceMetadataBehavior>();
    if (smb == null)
    {
        smb = new ServiceMetadataBehavior()
        {
            HttpGetEnabled = true
        };
        sh.Description.Behaviors.Add(smb);
    }
    sh.Credentials.UserNameAuthentication.UserNamePasswordValidationMode = System.ServiceModel.Security.UserNamePasswordValidationMode.Custom;
    sh.Credentials.UserNameAuthentication.CustomUserNamePasswordValidator = new CustUserNamePasswordVal();
    Binding mexbinding = MetadataExchangeBindings.CreateMexHttpBinding();
    sh.AddServiceEndpoint(typeof(IMetadataExchange), mexbinding, "mex");
    sh.Opened += delegate
    {
        Console.WriteLine("Service is ready");
    };
    sh.Closed += delegate
    {
        Console.WriteLine("Service is clsoed");
    };
    sh.Open();
    Console.ReadLine();
    //pause
    sh.Close();
    Console.ReadLine();
}

And the validation class, UserNamePasswordValidator.

    internal class CustUserNamePasswordVal : UserNamePasswordValidator
    {
        public override void Validate(string userName, string password)
        {
            if (userName != "jack" || password != "123456")
            {
                throw new FaultException("Username/Password is not correct");
            }
        }
}

Official link.
https://learn.microsoft.com/en-us/dotnet/framework/wcf/feature-details/how-to-use-a-custom-user-name-and-password-validator
https://learn.microsoft.com/en-us/dotnet/framework/wcf/samples/user-name-password-validator
Maybe I don’t fully understand your mean, feel free to let me know if there is anything I can help with.