WCF is very cool, but configuring WCF can virtually derail a project. Even relatively simple-seeming configurations can take hours or days to get working. It is frustrating! And the most complex part is getting security working.

The Microsoft Patterns and Practices group recently released beta guidance for WCF security (http://www.codeplex.com/wcfsecurityguide), and it is probably the single best resource for information about configuring WCF security you'll find anywhere.