What WCF extensibility point should I use to implement custom security?

Question

I'm trying to create a flexible security infrastructure for our WCF services on our intranet, but I'm not quite sure where I should be putting this code... there are so many different ways to extend WCF that I don't know for sure where to begin...

The basic idea: every time my service is called - for any operation - I want some code to run that does a custom access check using our existing security infrastructure to see if the user has access to perform the operation. If the user isn't authorized, I want it to throw an exception or something (not sure what it should do really) and prevent the call from ever making it to my service code.

Thoughts?

Thanks

Answer 1

I think that this will be a good starting point for implementing a custom authorization strategy.

Answer 2

I ended up having to use a MessageInspector in conjunction with a ParameterInspector to make it work how I needed.