Q:

Approaches for requiring forms authenticated users when calling a WCF restful service? 

Wondering about how to do the following efficiently, securely, and in a fashion that won't have us tearing our hair out because of overcomplication: we have an ASP.Net site that uses forms authentication and would like to implement some WCF restful web services that can be called from the first site, provided the user calling them has been authenticated.   
We'd like to host the WCF RESTful service in a different web site from the ASP.Net site.   Both sites will be in the same domain (my-domain.com for instance). 
I've been reading up on the various bindings in WCF and am not sure if webHttpBindings are the way to go here (they being the most REST-friendly, but can they accommodate forms-authenticated users?)   
I'm looking for suggestions and references as much as code, but I'd love to know where to start and what to look for, what's possible and what isn't.   
Every time I read about WCF authentication it seems to inevitably sluice into discussions about WS-security and X509 certificates, and I don't know that I need all that for what I'm doing?   What I'm really looking to build is a series of WCF restful services that only respond to forms-authenticated users.   If that's not possible without diving deep into WS-Security and X509 then so be it, but I'd like to keep it as simple as possible. 
Note:  I asked a somewhat similar question about a month ago, but have decided to go with forms authentication. 

A:

If you are not calling your WCF services from the browser, then you don't even need to secure them.   Just call them from your ASPX code to a non-public site that hosts WCF.  Or use X509 certs in a server-to-server mode. 
If you do plan to call them from the browser, then things get more complicated.   In this case, you may want to ditch WCF and look at with Web API included in the MVC 4 beta release to build your REST services.   
http://www.asp.net/web-api

