<p>I have a WCF service up and running and am able to communicate between the service and a .Net 2.0 Client using basicHttpBinding.  </p>

<p>I now need to lock down the WCF service so that it can only be called by authenticated clients.</p>

<p>I have control over the clients that will be calling my service. The clients are part of a product that will be installed in the wild and "phoning home" to push and pull data.  The client app is written for .Net 2.0 framework and cannot be upgraded to 3.0 or 3.5 at this time.  I cannot add windows user accounts to the client machines.</p>

<p>What are my options for securing the WCF Service and being able to authenticate from my .Net 2.0 clients?  Also, data needs to be passed over https.</p>

<p>I've been searching the web, and feel like I'm on a wild goose chase.</p>

Using SSL certificate is the only option for .NET 2.0 client accessing WCF service as basicHttpBinding provides no security. By using SSL, you are securing the whole transport channel.
Check the link
http://www.codeplex.com/WCFSecurityGuide/Release/ProjectReleases.aspx?ReleaseId=15892
. It covers WCF Security covering all scenarios.
To get free SSL certificate please visit
http://www.comodo.com/
or
http://www.instantssl.com/
and try out in your application.