ASP.NET Forms Auth For Downstream WCF Authentication and Authorization -

development environment: windows 7 enterprise .net 4.0 visual studio 2010

production environment: windows 2008 server iis 7.0

i'm trying figure out best way authenticate , authorize against wcf service running on separate machine in separate security zone asp .net web application.

users log in username , password against credentials have stored in database. did not implement membership provider, when user's credentials pass mustard, manually create forms auth ticket user id.

i did roll own role provider implements roleprovider. result, have "standard" asp .net roles along forms auth ticket working on our asp .net web application.

what need somehow pass these credentials along wcf service that's sitting on machine. originally, thought might use windows identity foundation , create custom security token service (sts). basically, if user authenticates, create token , add in claims based authorization along user identity token , pass along wcf service.

we currently using .net remoting service (.net 1.1 timeframe) not authenticate or authorize @ all.

that seems might bit of overkill there might way pass along information have user when create forms auth ticket, know current iprinciple set iidentity set "name" property set user id on thread.currentidentity.

i'm pretty sure isinrole("whateverrole") work correctly @ point too, of on web application side. nothing gets passed .net remoting service.

looking @ these 2 classes:
authenticationservice class
serviceauthorization class
don't think want. likewise, i've read through michele bustamante's learning wcf, don't see particular scenario covered. when read windows authentication, keep thinking needs tied internal ntlm or kerberos associated internal windows security situation. none of our users internal users. they're strictly external.

now, know if user gets forms auth ticket, valid iprinciple , roles should set, right?

if so, there way pass along wcf service setting on machine? if set wcf clientcredentialtype windows , set serviceauthorization principlepermissionmode "useaspnetroles", these passed along in security context web application wcf service when make service call?

nothing can find clear on how might happen. thanks.

i think want this:

http://thoughtorientedarchitecture.blogspot.com/2009/10/flowing-aspnet-forms-authentication.html

this isn't super secure, since you're creating own man-in-the-middle attack, it's secure enough needs.

essentially boils down this:

1. configure both servers same machinekey
2. grab formsauthentication cookie user request
3. attach cookie outgoing wcf service call
4. ???
5. profit