Hi,everybody

look below code in page 119 of Web Service Security
Scenarios, Patterns, and Implementation Guidance
for Web Services Enhancements (WSE) 3.0:

protected override string AuthenticateToken( UsernameToken token )
{
bool validCredentials = Membership.ValidateUser(token.Username,
token.Password);
if (!validCredentials)
{
throw new ApplicationException(Resources.Messages.AuthenticationError);
}
GenericIdentity identity = new GenericIdentity(token.Username);
GenericPrincipal principal = new GenericPrincipal(identity,
Roles.GetRolesForUser(token.Username));
token.Principal = principal;
return token.Password;
}

Do invoke AuthenticateToken method for each request?if yes,that have any
performance problem?

Because I wonder this thing,so I do that:

protected override string AuthenticateToken(UsernameToken token)
   {
     if (token.PasswordOption != PasswordOption.SendPlainText)
       throw new ArgumentException("token is only SendPlainText");
     string password = token.Password;
     Microsoft.Practices.EnterpriseLibrary.Security.IToken cacheToken =
new MyCacheToken(token.Username);
     IPrincipal principal=
Microsoft.Practices.EnterpriseLibrary.Security.ISecurityCacheProvider.Ge
tPrincipal(cacheToken);
     if (principal == null)
     {
       bool isAuth = Membership.ValidateUser(token.Username, password);
       if (isAuth)
       {
         principal= MyPrincipal.Create(cacheToken);
       }
       else
       {
         this.OnLogonUserFailed(token);
       }
     }
     token.Principal = principal;
     return password;
   }

My code is right?