How to declaratively implement custom IAuthorizationPolicy in WCF?

Question

I have a WCF service that is hosted in IIS. I want to use my own IAuthorizationPolicy, and have it configured in the web.config file on the server. I have my auth policy:

namespace MyLib.WCF
{
    public class CustomAuthorizationPolicy : IAuthorizationPolicy
    {
        public CustomAuthorizationPolicy()
        {
            this.Id = Guid.NewGuid().ToString();
        }

        public bool Evaluate(EvaluationContext evaluationContext, ref object state)
        {
            throw new ApplicationException("Testing custom auth");
        }
        ...
    }
}

And in my web.config:

<service behaviorConfiguration="Behavior" name="MyService">
    <endpoint address="" binding="wsHttpBinding"  contract="IMyService"/>      
    <endpoint address="mex" binding="mexHttpBinding" contract="IMetadataExchange"/>
</service>
<serviceBehaviors>
    <behavior name="Behavior">
        <serviceAuthorization principalPermissionMode="Custom">
            <authorizationPolicies>
     <add policyType="MyLib.WCF.CustomAuthorizationPolicy, MyLib.WCF, Version=1.0.0.0, Culture=neutral, PublicKeyToken=null" />
            </authorizationPolicies>
        </serviceAuthorization>
    </behavior>
</serviceBehaviors>

But my CustomAuthorizationPolicy.Evaluate() method never fires. What am I missing?

Answer 1

Well, the obvious (silly) question is: in your <service>, do you actually reference your behavior configuration??

I.e. do you have:

<system.serviceModel>    
 ....
   <service name="YourService" behaviorConfiguration="Behavior">
       ....
   </service>
 ....
</system.serviceModel>

Just defining all your stuff is nice and well - but unless you've actually referenced it, it won't do you any good (been there, done that myself, too! :-) )

Second (almost as silly) question would be: what binding and security config do you use?? Have you even turned on security at all? If you have <security mode="None">, then your service authorization will obviously never be used, either (since no credentials are being passed to the service at all).

Marc