title: WCF CustomRoleProvider and Principle Permissions
body: <p><strong>EDIT: I think that the issue may be related to the issue below as I'm also using SSL</strong>
  <a href="https://stackoverflow.com/questions/6085730/principalpermission-demand-failing-once-wcf-service-was-moved-to-ssl">PrincipalPermission.Demand() failing once WCF Service was moved to SSL</a></p>
  
  <p>I'm working on a secure set of web services, I've implemented a CustomRoleProvider and CustomMembershipProvider in order to authenticate users.</p>
  
  <p>This works great, however I would like to restrict access to the majority of service calls if the user is not authenticated.</p>
  
  <p>i planned on using the following to accomplish this</p>
  
  <pre><code>[PrincipalPermission(SecurityAction.Demand, Authenticated=true)]
  </code></pre>
  
  <p>However, this doesn't seem to detect when a user is authenticated and always throws a security exception. I'm not really sure what I've done wrong.</p>
  
  <pre><code>public class CustomMembershipProvider : MembershipProvider
  {
      public string UserType;
  
      public override bool ValidateUser(string username, string password)
      {
             //Custom logic to work out if user exists and password is correct
  
             //If the user exists and password matches we will get a populated user
             //object containing their username and usertype
  
              if (user == null)
              {
                  return false;
              }
              else
              {
                  return true;
              }
          }
      }
  </code></pre>
  
  <p>Within my authentication service call i check if the membership provider returns true and sets a forms authentication cookie.</p>
  
  <pre><code>        if (Membership.ValidateUser(username, password))
          {
              FormsAuthentication.SetAuthCookie(username, false);
          }
  </code></pre>
  
  <p>I've set up service Authorization in my web config as follows:</p>
  
  <pre><code>    &lt;behavior name="SecureAuthServiceBehavior"&gt;
        &lt;serviceAuthorization principalPermissionMode="UseAspNetRoles" roleProviderName="CustomRoleProvider"/&gt;
        .... 
       &lt;/behaviour&gt;
  </code></pre>
  
  <p>Any help would be greatly appreciated, Thanks</p>
  
  <p>EDIT: </p>
  
  <p>I've done some further investigation into the issue and discovered that the Principal is being set correctly.
   i have the following Service method, within it I get the Principal and check if the user is in the correct role, effectively doing what the tag at the start is doing.</p>
  
  <pre><code>[PrincipalPermission(SecurityAction.Demand,Role="A" )]
  public bool DoWork()
  {
      IPrincipal p = HttpContext.Current.User;
      if (p.IsInRole("A"))
      {
          return true;
      }
      else
      {
          return false;
       }
  }
  </code></pre>
  
  <p>This method currently throws a SecurityException every time however if I comment out the principal permission at the start then the method works and returns true.</p>