The patterns & practices team at Microsoft has put together their first release of guidance for WCF security. They've included how-to guides and videos that walk you through a number of security tasks, such as working with certificates and configuring role providers. The overall guide is still under development so these represent individual modules that are being published as they're completed.
Here's what's currently available:
Shouldn't the guidance on Impersonation simply state
You don't need it
It's a relic of the past
Don't do it
Hi Johnny,
Impersonation is still quite useful but it's best used sparingly, inside the enterprise where there's a mutually trusted environment. You'll still need impersonation for many years to come until all the infrastructure has been updated to support more advanced methods for federation and delegation.
After the first announcement for the WCF Security Guidance Project , the amount of content has grown