Always protect the message and provide for message confidentiality and integrity.
In an intranet, you can use transport security without message security as long as the protection level is set to EncryptAndSign.
In an intranet, avoid impersonation. Set the impersonation level to TokenImpersonationLevel.Identification.
When using impersonation, have the client use TokenImpersonationLevel.Impersonation.
Use the declarative security framework and avoid manual configuration.
Never apply the PrincipalPermissionAttribute directly on the service class:
//Will always fail: [PrincipalPermission(SecurityAction.Demand,Role = "...")] public class MyService : IMyContract {...}
Avoid sensitive work that requires authorization at the service constructor.
Avoid demanding a particular user, with or without demanding a role:
//Avoid: [PrincipalPermission(SecurityAction.Demand,Name = "John")] public void MyMethod( ) {...}
Do not rely on role-based security in the client's callback operations.
With Internet clients, always use message security.
Allow clients to negotiate the service certification (the default).
Use the ASP.NET providers for custom credentials.
When developing a custom credentials store, develop it as an ASP.NET provider.
Validate certificates using peer trust.
