I’ve been reading up on WCF security recently. These two articles by Michele Leroux Bustamante are well worth the read.

http://www.code-magazine.com/articleprint.aspx?quickid=0611051

http://www.theserverside.net/tt/articles/showarticle.tss?id=ClaimsBasedSecurityModel