ASP.NET Membership Provider authentication not working authenticating WCF Service

Question

I have a SqlMembershipProvider store with Roles enabled. This is configured and has the user "devtest" in the roles "xxUser" and "xxAdmin".

I also have a WCF service, which I want to authenticate and authorize against. My problem is that:

1. the authorisation is not happening, code just executes despite the policy attribute
2. I don't get any identity or security context so do not know who is calling the service

I need:

1. to know which user is calling the method
2. some degree of rejecting users if permissions don't match up (ideally this should be performed within the RoleProvider/MembershipProvider/WCF but can do it myself if I have to)
3. SSL in transport

I have my service contract set up thus:

    [ServiceContract]
    public interface ISupportService
    {
        [OperationContract]
        [PrincipalPermission(SecurityAction.Demand, Role = "ThisRoleDoesNotExist")]
        List<BaseInterestRate> GetAllBaseInterestRates();
    }

the code is simple enough:

public class SupportService : ISupportService
{
    public List<BaseInterestRate> GetAllBaseInterestRates()
    {
        OperationContext operationContext = OperationContext.Current;
        ServiceSecurityContext serviceSecurityContext = ServiceSecurityContext.Current; // is always null

        using (xxxEntities entities = new xxxEntities())
        {
            return new List<BaseInterestRate>(entities.BaseInterestRates);
        }
    }}

My service configuration is thus:

-->

<behaviors>
  <serviceBehaviors>
      <behavior name="SupportServiceBehavior">
          <serviceMetadata httpGetEnabled="false" httpsGetEnabled="true" />
          <serviceDebug includeExceptionDetailInFaults="false" />
          <serviceAuthorization principalPermissionMode="UseAspNetRoles" roleProviderName="AspNetSqlRoleProvider" />
          <serviceCredentials>
              <userNameAuthentication userNamePasswordValidationMode="MembershipProvider" 
 membershipProviderName="SqlMembershipProvider" />
          </serviceCredentials>
      </behavior>
    <behavior>     
      <serviceMetadata httpGetEnabled="true"/>
      <serviceDebug includeExceptionDetailInFaults="false"/>
    </behavior>
  </serviceBehaviors>
</behaviors>
<serviceHostingEnvironment multipleSiteBindingsEnabled="true" />

Having already configured the MembershipProvider:

  <membership defaultProvider="SqlMembershipProvider" >
      <providers>
          <clear/>
          <add name="SqlMembershipProvider"
   connectionStringName="SqlMembershipProvider"
   applicationName="xxx"
   type="System.Web.Security.SqlMembershipProvider" />
      </providers>
  </membership>
  <roleManager enabled="true">
      <providers>
          <clear />
          <add connectionStringName="SqlMembershipProvider" applicationName="xxx"
           name="AspNetSqlRoleProvider" type="System.Web.Security.SqlRoleProvider" />
          <add applicationName="xxx" name="AspNetWindowsTokenRoleProvider"
           type="System.Web.Security.WindowsTokenRoleProvider" />
      </providers>
  </roleManager>

I have followed the instructions at these pages to the letter:

• How to: Use the SQL Server Role Provider with Windows Authentication in WCF Calling from Windows Forms (MSDN)
• How to: Create and Install Temporary Client Certificates in WCF During Development (MSDN)
• How to: Use wsHttpBinding with Username Authentication and TransportWithMessageCredentials in WCF Calling from Windows Forms (MSDN)
• Also quite useful found via SO: Use Asp.Net Membership provider with a WCF .svc service (Alkampfer's Place)

I would at lest expect an issue with certificates/transport/etc. to fail with exceptions, but I can debug right in and over the WCF call. I have no security context/ user context available to me and when I use a user not in the two mentioned roles (which I do in the code example above), I don't get "kicked out".

My client app is currently a Web App, but will ultimately also serve a Windows Forms app and Test suite. I'm currently using the ASP.NET WebDev server and am running .NET 4.0.

Am I missing something?