title: Thread.CurrentPrincipal is not set in WCF service called using WebGet
body: <p>I have a web site hosted in IIS that uses Windows Authentication and exposes WCF web services.</p>
  
  <p>I configure this service with an endpoint behavior:</p>
  
  <pre><code>&lt;serviceAuthorization principalPermissionMode ="UseAspNetRoles" 
                     roleProviderName="MyRoleProvider"/&gt;
  </code></pre>
  
  <p>and a binding:</p>
  
  <pre><code> &lt;security mode="TransportCredentialOnly"&gt;
      &lt;transport clientCredentialType="Ntlm" /&gt;
   &lt;/security&gt;
  </code></pre>
  
  <p>When the service is called, <code>Thread.CurrentPrincipal</code> is set to a <code>RolePrincipal</code> with the client's Windows identity and roles provided by by configured provider.</p>
  
  <p>All is well with the world.</p>
  
  <p>Now I've added some additional WCF services that are consumed by REST-ful Ajax calls: <code>Factory="System.ServiceModel.Activation.WebScriptServiceHostFactory"</code> in the svc file, <code>WebGet</code> attribute in the service contract, and the <code>AspNetCompatibilityRequirements(RequirementsMode = AspNetCompatibilityRequirementsMode.Allowed)</code> attribute on the service implementation.</p>
  
  <p>I also add the following incantation to web.config as recommended in MSDN:</p>
  
  <pre><code>&lt;system.serviceModel&gt;
      ...
      &lt;serviceHostingEnvironment aspNetCompatibilityEnabled="true" /&gt;
      ...
  &lt;/system.serviceModel&gt;
  </code></pre>
  
  <p>My Ajax service <em>almost</em> works the way I want it to.  When it's called, <code>HttpContext.Current.User</code> is set to a <code>RolePrincipal</code> with the roles I expect.  But <code>Thread.CurrentPrincipal</code> remains set to an unauthenticated <code>GenericPrincipal</code>.</p>
  
  <p>So I need to add a line of code to each of my service methods:</p>
  
  <pre><code>Thread.CurrentPrincipal = HttpContext.Current.User
  </code></pre>
  
  <p>Is there any incantation in the configuration file I can use to get <code>Thread.CurrentPrincipal</code> to be set automagically, like it is for a normal SOAP service?</p>
  
  <p><strong>UPDATE</strong>
  <a href="http://bartekszafko.pl/2011/09/25/integrating-wcf-services-with-forms-authentication/" rel="noreferrer">Here's</a> a blog from someone who had the same problem, and solved it by implementing custom behaviors.  Surely there's a way to do this out of the box?</p>
  
  <p><strong>UPDATE 2</strong>
  Coming back to add a bounty to this as it's bugging me again in a new project, using a WCF WebGet-enabled service on .NET 3.5.</p>
  
  <p>I've experimented with a number of options, including setting principalPermissionMode="None", but nothing works.  Here's what happens:</p>
  
  <ul>
  <li><p>I navigate to a WebGet URL that calls my service: <code>http://myserver/MyService.svc/...</code></p></li>
  <li><p>I've put a breakpoint in Global.asax "Application_AuthorizeRequest".  When this breakpoint is hit, both "HttpContext.Current.User" and "Thread.CurrentPrincipal" have been set to a "RolePrincipal" that uses my configured ASP.NET RoleProvider.  This is the behavior I want.</p></li>
  <li><p>I have a second breakpoint when my service's OperationContract method is called.  When this breakpoint is hit, HttpContext.Current.User still references my RolePrincipal, but Thread.CurrentPrincipal has been changed to a GenericPrincipal.  Aaargh.</p></li>
  </ul>
  
  <p>I've seen suggestions to <a href="http://social.msdn.microsoft.com/Forums/vstudio/en-US/8f424d4f-2f47-4f85-a6b0-00f7e58871f1/wcf-principalpermission-on-methods-and-forms-authentication-issue?forum=wcf" rel="noreferrer">implement a custom IAuthorizationPolicy</a>, and will look into that if I don't find a better solution, but why should I need to implement a custom policy to make use of existing ASP.NET authorization functionality?  If I have principalPermissionMode = "UseAspNetRoles", surely WCF should know what I want?</p>