I have seen several questions about how to fill out a binding template for CreateServiceProxy(). Here are two examples which I believe should help you with this task.

In the first example, I increase the size of messages allowed for the client to send to the service. To do that the code changes the corresponding channel property for a channel that the Service Proxy is  going to use.

// defining the desirable maximum size for messages
ULONG maxMessageSize = 2147483647;

//changing a channel property
WS_CHANNEL_PROPERTY channelProperty[1];
channelProperty[0].id = WS_CHANNEL_PROPERTY_MAX_BUFFERED_MESSAGE_SIZE;
channelProperty[0].value = &maxMessageSize;
channelProperty[0].valueSize = sizeof(maxMessageSize);
WS_CHANNEL_PROPERTIES channelProperties;
channelProperties.properties = channelProperty;
channelProperties.propertyCount = 1;

// filling in out the template with the new channel property
WS_HTTP_BINDING_TEMPLATE templateValue = {};
templateValue.channelProperties = channelProperties;

// creating Service Proxy using the changed binding template
hr = WSHttpBinding_IArraySort_CreateServiceProxy(&templateValue,
                                                 NULL, 0,
                                                 &serviceProxy,
                                                 error);

In the second example, we provide a username and a password from the client to the service. We start from creating a User Credential structure that later on passed to the binding template. Username and password will be send to the service on a call to its operation.

// declare and initialize a username credential
WS_STRING_USERNAME_CREDENTIAL usernameCredential = {};
usernameCredential.credential.credentialType = WS_STRING_USERNAME_CREDENTIAL_TYPE;
usernameCredential.username.chars = username;
usernameCredential.username.length = wcslen(username);
usernameCredential.password.chars = password;
usernameCredential.password.length = wcslen(password);
// declare and initialize a username message security binding
WS_HTTP_SSL_USERNAME_SECURITY_CONTEXT_BINDING_TEMPLATE templateValue = {};
templateValue.usernameMessageSecurityBinding.clientCredential = &usernameCredential.credential;

// Creating Service Proxy using template fucntion generated from the metadata
hr = WSHttpBinding_ICalculator_CreateServiceProxy(    &templateValue,
                                                    NULL, 0,
                                                    &serviceProxy,
                                                    error);

These two examples demonstrate the general approach. There are 13 binding templates in the API listed here. They all can be filled in using the similar approach. Give it a try and if you have questions just post them as comments to this post.