c# - WCF Custom Authorization -

basically, i'm creating first ever wcf web service , i'm looking implement custom authentication , authorization. authentication seems working well, want able store roles , permissions using custom authorization well.

my authentication done overriding usernamepasswordvalidator , making use of validate method.

validate(string username, string password) 

now i've tried implementing authorization using iauthorizationpolicy interface

public class authorizationpolicy : iauthorizationpolicy {     private string _id;      public string id     {         { return this._id; }     }      public claimset issuer     {         { return claimset.system; }     }      public authorizationpolicy()     {         _id = guid.newguid().tostring();     }      public bool evaluate(evaluationcontext context, ref object state)     {         iidentity client = getclientidentity(context);         context.properties["principal"] = new customprincipal(client);          return true;     }      private iidentity getclientidentity(evaluationcontext evaluationcontext)     {         object obj;         if (!evaluationcontext.properties.trygetvalue("identities", out obj))             throw new exception("no identity found");          ilist<iidentity> identities = obj ilist<iidentity>;         if (identities == null || identities.count <= 0)             throw new exception("no identity found");          return identities[0];     } } 

and i've implemented customprincipal using iprincipal interface.

public class customprincipal : iprincipal {     iidentity _identity;     string[] _roles;      public customprincipal(iidentity identity)     {         _identity = identity;     }      public static customprincipal current     {                 {             return thread.currentprincipal customprincipal;         }     }      public iidentity identity     {         { return _identity; }     }      public string[] roles     {                 {             if (_roles == null)             {                 ensureroles();             }              return _roles;         }     }      public bool isinrole(string role)     {         ensureroles();          return _roles.contains(role);     }      protected virtual void ensureroles()     {         usermanager usermanager = new usermanager();         int userpermissions = usermanager.userpermissions(_identity.name);          if (userpermissions == 1)             _roles = new string[1] { "admin" };         else             _roles = new string[1] { "user" };     } } 

my app.config has been updated required, , evaluate method in authorizationpolicy called expected.

however, i'm stuck. how go implementing roles , permissions here?

i suggest opt message inspector.

the logic follows:

1. client have message inspector set required headers each request.
2. server side message inspector intercept request , read headers , authentication , authorization.
3. you can have couple of services user , role service can invoked in server validate credentials in header , set identity request.
4. these services accessing store through dal , in inproc mode.