When you return false from the ServiceAuthorizationManager‘s CheckAccessCore method, WCF sends a special fault message back to the client. The logic looks more or less like this:

private Exception CreateAccessDeniedFault()
{
  FaultCode code = FaultCode.CreateSenderFaultCode(
    "FailedAuthentication",
    "http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd");

    FaultReasonText faultText = 
      new FaultReasonText("Access is Denied.", CultureInfo.CurrentCulture);

    return new FaultException(new FaultReason(faultText), code);
}

This fault message gets turned into a SecurityAccessDeniedException in the (WCF) client that you can catch.

Now maybe you are also doing authorization from within your service operation and wanna return the same fault in case access is denied (and you don’t want to come up with some custom fault which would mean you have to look for either the access denied exception *or* some fault exception). How does that work?

Well – first I used the above code to handcraft the fault but it turns out that it is much simpler.

The only thing you have to do is to throw a SecurityException from your operation. doh.