title: Why isn't the Identities property passed to my custom IAuthorisationPolicy?
body: <p>I'm trying to set up a custom IAuthorisationPolicy that I can give to ServiceAuthorizationBehaviour to install my own IPrincipal implementation. I've followed the instructions <a href="http://www.leastprivilege.com/CommentView.aspx?guid=b0debb25-1647-419a-81e4-9961257a5dce" rel="nofollow noreferrer">here</a>, and written a test that verifies that this works when self-hosting using a NetNamedPipes binding. </p>
  
  <p>The problem is, when I try to use this hosted under IIS the Identities property is not being set in the evaluationContext that is passed to my IAuthorisationPolicy (whereas it is when self-hosting).</p>
  
  <p>The following is an extract from my configuration file:</p>
  
  <pre><code>&lt;customBinding&gt;
          &lt;binding name="AuthorisedBinaryHttpsBinding" receiveTimeout="00:03:00" sendTimeout="00:03:00"&gt;
            &lt;security authenticationMode="UserNameOverTransport"&gt;
            &lt;/security&gt;
            &lt;binaryMessageEncoding&gt;
            &lt;/binaryMessageEncoding&gt;
            &lt;httpsTransport /&gt;
          &lt;/binding&gt;
        &lt;/customBinding&gt;
      &lt;/bindings&gt;
      &lt;behaviors&gt;
        &lt;serviceBehaviors&gt;
          &lt;behavior name="CommonServiceBehaviour"&gt;
            &lt;serviceCredentials&gt;
              &lt;userNameAuthentication userNamePasswordValidationMode="MembershipProvider"
                                      membershipProviderName="AdminSqlMembershipProvider"/&gt;
            &lt;/serviceCredentials&gt;
            &lt;serviceMetadata httpGetEnabled="true" /&gt;
            &lt;dataContractSerializer maxItemsInObjectGraph="2147483647" /&gt;
          &lt;/behavior&gt;
        &lt;/serviceBehaviors&gt;
      &lt;/behaviors&gt;
  </code></pre>
  
  <p>(Note that I'm configuring the ServiceAuthorisationBehavior through code, which is why it doesn't appear here)</p>
  
  <p>Any idea why I'm not being passed the Identities property?</p>
  
  <p>My IAuthorisationPolicy looks like this:</p>
  
  <pre><code>public class PrincipalInstallingAuthorisationPolicy : IAuthorizationPolicy
  {
      public bool Evaluate(EvaluationContext evaluationContext, ref object state)
      {
          var identity = GetClientIdentity(evaluationContext);
          if (identity == null)
          {
              return false;
          }
              // var groups = get groups
              var principal = new GenericPrincipal(identity, groups);
              evaluationContext.Properties["Principal"] = principal;
  
  
          return true;
      }      
  
      private IIdentity GetClientIdentity(EvaluationContext evaluationContext)
      {
          object obj;
          if (!evaluationContext.Properties.TryGetValue("Identities", out obj))
          {
              return null;
          }
  
          IList&lt;IIdentity&gt; identities = obj as IList&lt;IIdentity&gt;;
          if (identities == null || identities.Count &lt;= 0)
          {
              return null;
          }
  
          return identities[0];
      }
  
      ...
   }
  </code></pre>