class Service : IService {
  // only 'users' role member can call this method
  [PrincipalPermission(SecurityAction.Demand, Role = 'users')]
  public string[] GetRoles(string username) {
    // only administrators can retrieve the role information for other users
    if (ServiceSecurityContext.Current.PrimaryIdentity.Name != username) {
      if (Thread.CurrentPrincipal.IsInRole('administrators')) {
        ...
      }
      else {
        // access denied
        throw new SecurityException();
      }
    }
  }
}

var factory = new ChannelFactory<IService>('*');
factory.Credentials.UserName.UserName = 'bob';
factory.Credentials.UserName.Password = 'bob';
var proxy = factory.CreateChannel();

try {
  Console.WriteLine('\nBob: roles for Bob --');
  proxy.GetRoles('bob').ToList().ForEach(i => Console.WriteLine(i));

  Console.WriteLine('\nBob: roles for Alice --');
  proxy.GetRoles('alice').ToList().ForEach(i => Console.WriteLine(i));
}

catch (SecurityAccessDeniedException) {
  Console.WriteLine('Access Denied\n');
}

class CustomRoleProvider : RoleProvider {
  public override string[] GetRolesForUser(string username) {
    if (username == 'administrator') {
      return new string[] { 'administrators', 'users' };
    }
    else {
      return new string[] { 'sales', 'marketing', 'users' };
    }
  }

  public override bool IsUserInRole(string username, string roleName)  {
    return GetRolesForUser(username).Contains(roleName);
  }
  ...
}

<behaviors>
  <serviceBehaviors>
    <behavior name='security'>
      <serviceAuthorization 
        principalPermissionMode='UseAspNetRoles'
        roleProviderName='CustomProvider'
      </serviceAuthorization>
    </behavior>
  </serviceBehaviors>
</behaviors>

<system.web>
  <roleManager 
    enabled='true'
    defaultProvider='CustomProvider'>
    <providers>
      <add name='CustomProvider' 
        type='Service.CustomRoleProvider, Service' />
    </providers>
  </roleManager>
</system.web>

class CustomPrincipal : IPrincipal {
  IIdentity _identity;
  string[] _roles;
  Cache _cache = HttpRuntime.Cache;

  public CustomPrincipal(IIdentity identity) {
    _identity = identity;
  }

  // helper method for easy access (without casting)
  public static CustomPrincipal Current {
    get {
      return Thread.CurrentPrincipal as CustomPrincipal;
    }
  }

  public IIdentity Identity {
    get { return _identity; }
  }

  // return all roles (custom property)
  public string[] Roles {
    get {
      EnsureRoles();
      return _roles;
    }
  }

  // IPrincipal role check
  public bool IsInRole(string role) {
    EnsureRoles();

    return _roles.Contains(role);
  }

  // cache roles for subsequent requests
  protected virtual void EnsureRoles() {
    // caching logic omitted – see the sample download
  }
}

class AuthorizationPolicy : IAuthorizationPolicy {
  // called after the authentication stage
  public bool Evaluate(EvaluationContext evaluationContext, 
     ref object state) {
    // get the authenticated client identity from the evaluation context
    IIdentity client = GetClientIdentity(evaluationContext);

    // set the custom principal
    evaluationContext.Properties['Principal'] = 
       new CustomPrincipal(client);

    return true;
  }

  // rest omitted
}

<behaviors>
  <serviceBehaviors>
    <behavior name='security'>       
      <serviceAuthorization principalPermissionMode='Custom'>
        <authorizationPolicies>
          <add policyType='Service.AuthorizationPolicy, Service' />
        </authorizationPolicies>
      </serviceAuthorization>
    </behavior>
  </serviceBehaviors>
</behaviors>

class AuthorizationManager : ServiceAuthorizationManager {
  public override bool CheckAccess(
    OperationContext operationContext, ref Message message) {

    base.CheckAccess(operationContext, ref message);
    string action = operationContext.IncomingMessageHeaders.Action;

    if (action == 'urn:msdnmag/IService/GetRoles') {
      // messags in WCF are always read-once
      // we create one copy to work with, and one copy for WCF
      MessageBuffer buffer = operationContext.RequestContext.RequestMessage.
        CreateBufferedCopy(int.MaxValue);
      message = buffer.CreateMessage();

      // get the username value using XPath
      XPathNavigator nav = buffer.CreateNavigator();
      StandardNamespaceManager nsm = new 
        StandardNamespaceManager(nav.NameTable);
      nsm.AddNamespace('msdn', 'urn:msdnmag');

      XPathNavigator node = nav.SelectSingleNode
        ('s:Envelope/s:Body/msdn:GetRoles/msdn:username', nsm);
      string parameter = node.InnerXml;

      // check authorization
      if (operationContext.ServiceSecurityContext.PrimaryIdentity.Name == 
        parameter) {
        return true;
      }
      else {
        return (GetPrincipal(operationContext).IsInRole(
          'administrators'));
      }
    }
  return true;
  }
  // rest omitted
}

<serviceAuthorization 
  serviceAuthorizationManagerType='Service.AuthorizationManager, Service'>

public void ShowAuthorizationContext() {
  AuthorizationContext context =
    ServiceSecurityContext.Current.AuthorizationContext;

  foreach (ClaimSet set in context.ClaimSets) {
    Console.WriteLine('\nIssuer:\n');
    Console.WriteLine(set.Issuer.GetType().Name);
    foreach (Claim claim in set.Issuer) {
      ShowClaim(claim);
    }

    Console.WriteLine('\nIssued:\n');
    Console.WriteLine(set.GetType().Name);
    foreach (Claim claim in set) {
      ShowClaim(claim);
    }
  }
}

private void ShowClaim(Claim claim) {
  Console.WriteLine('{0}\n{1}\n{2}\n',
    claim.ClaimType,
    claim.Resource,
    claim.Right);
}

class CustomerAuthorizationPolicy : IAuthorizationPolicy {
  Guid _id = Guid.NewGuid();
  // custom issuer claim set
  ApplicationIssuerClaimSet _issuer = new ApplicationIssuerClaimSet();

  public bool Evaluate(EvaluationContext evaluationContext, 
    ref object state) {
    Claim id = evaluationContext.ClaimSets.FindIdentityClaim();
    string userId = Map(id);

    evaluationContext.AddClaimSet(this, new CustomerClaimSet(userId));

    return true;
  }

  public ClaimSet Issuer {
    get { return _issuer; }
  }

  public string Id {
    get { return 'CustomerAuthorizationPolicy: ' + _id.ToString(); }
  }
}

public void PlaceOrder(Order order) {
  int purchaseLimit = GetPurchaseLimit();

  if (Order.Total > purchaseLimit) {
    // do appropriate action
  }
}

private int GetPurchaseLimit() {
  AuthorizationContext context = 
    ServiceSecurityContext.Current.AuthorizationContext;

  foreach (ClaimSet set in context.ClaimSets) {
    foreach (Claim claim in set.FindClaims(
      Constants.PurchaseLimitClaimType, 
      Rights.PossessProperty)) {

      return int.Parse(claim.Resource.ToString());
    }
  }

  throw new Exception('Claim not found');
}