forms authentication - WCF CustomRoleProvider and Principle Permissions -

edit: think issue may related issue below i'm using ssl principalpermission.demand() failing once wcf service moved ssl

i'm working on secure set of web services, i've implemented customroleprovider , custommembershipprovider in order authenticate users.

this works great, restrict access majority of service calls if user not authenticated.

i planned on using following accomplish this

[principalpermission(securityaction.demand, authenticated=true)] 

however, doesn't seem detect when user authenticated , throws security exception. i'm not sure i've done wrong.

public class custommembershipprovider : membershipprovider {     public string usertype;      public override bool validateuser(string username, string password)     {            //custom logic work out if user exists , password correct             //if user exists , password matches populated user            //object containing username , usertype              if (user == null)             {                 return false;             }             else             {                 return true;             }         }     } 

within authentication service call check if membership provider returns true , sets forms authentication cookie.

        if (membership.validateuser(username, password))         {             formsauthentication.setauthcookie(username, false);         } 

i've set service authorization in web config follows:

    <behavior name="secureauthservicebehavior">       <serviceauthorization principalpermissionmode="useaspnetroles" roleprovidername="customroleprovider"/>       ....       </behaviour> 

any appreciated, thanks

edit:

i've done further investigation issue , discovered principal being set correctly. have following service method, within principal , check if user in correct role, doing tag @ start doing.

[principalpermission(securityaction.demand,role="a" )] public bool dowork() {     iprincipal p = httpcontext.current.user;     if (p.isinrole("a"))     {         return true;     }     else     {         return false;      } } 

this method throws securityexception every time if comment out principal permission @ start method works , returns true.

principalpermission checks thread.currentprincipal, not httpcontext.current.user, that's why principalpermission attribute commented out dowork() returns true, line present returns false (because thread.currentprincipal isn't set anything).

in constructor of service class set thread.currentprincipal = httpcontext.current.user , match correctly. principalpermission attribute blocks/allows expect to.