Impersonation in WCF Service and propagating to COM object

Question

I'm trying to create a WCF service to expose a some services. In one of contracts I have to impersonate to another user and call a COM object. I know that if I want to propagate impersonation into COM object I should call CoInitializaSecurity before any marshaling.

int result = CoInitializeSecurity(IntPtr.Zero, -1,
 IntPtr.Zero, IntPtr.Zero,
            RpcAuthnLevel.Connect, RpcImpLevel.Impersonate,
            IntPtr.Zero, EoAuthnCap.DynamicCloaking, IntPtr.Zero);

but it returns 80010119 which means RPC_E_TOO_LATE.

I know that it means CoInitializeSecurity has been already called. But I want to call this function as first instruction in my contract. I've tried calling CoInitializeSecurity even in constructor of service but it returns same error. It means WCF built in codes contains CoInitializeSecurity and I can't run this function again.

I want to call a com object and I want to make com object to work with impersonated user in C# but if I'm nut successful in calling CoInitializeSecurity it means COM object will not run by impersonated user.

---

Just added after answer by @Remus Rusanu

I've created a service contract like following

   [OperationBehavior(Impersonation = ImpersonationOption.Required)]
    public string GetData()
    {
        MyComClass comObj = new MyComClass();
        string ComUser = comObj.GetLogOnUser();
        return System.Security.Principal.WindowsIdentity.GetCurrent().Name + " " + ComUser;
    }

and in client I called this service by desired credentials

    ServiceReference1.Service1Client client = new ServiceReference1.Service1Client();
    client.ClientCredentials.Windows.AllowedImpersonationLevel = System.Security.Principal.TokenImpersonationLevel.Impersonation;
    client.ClientCredentials.Windows.ClientCredential.Domain = "Domain";
    client.ClientCredentials.Windows.ClientCredential.UserName = "DomainUser";
    client.ClientCredentials.Windows.ClientCredential.Password = "passw0rd";
    string str = client.GetData();

the result is

DOMAIN\DomainUser DOMAIN\CurrentUser

Which means WCF has impersonated to DomainUser but inside of COM object is still working with previous user.

Answer 1

The managed hosting is initializing COM for you already. You do not have to re-initialize the thread COM security. Simply impersonate in the WCF (eg. via [OperationBehavior(Impersonation=ImpersonationOption.Required)]) and make the COM object instantiation, it will occur under an impersonated context. Not that if the COM object is remote then constrained delegation occurs and your WCF host process has to be configured for constrained delegation.

See How to: Impersonate a Client on a Service, Delegation and Impersonation with WCF and Enabling Delegated Authentication