Index: /branches/HeuristicLab.Services.Authentication Prototype/Service/App.config
===================================================================
--- /branches/HeuristicLab.Services.Authentication Prototype/Service/App.config	(revision 4020)
+++ /branches/HeuristicLab.Services.Authentication Prototype/Service/App.config	(revision 4021)
@@ -8,8 +8,19 @@
           <add
             name="HeuristiclabMemberShipProvider"
-            type="Service.Provider.HeuristicLabMembershipProvider, Service"
+            type="Service.Provider.HeuristicLabRoleProvider, Service"
+            applicationName="HeuristicLabServices"
             passwordFormat= "Hashed"/>
         </providers>
       </membership>
+    <roleManager enabled ="true"
+   defaultProvider ="HeuristicLabRoleProvider" >
+      <providers>
+        <clear/>
+        <add name ="HeuristicLabRoleProvider"
+          type="Service.Provider.HeuristicLabRoleProivder, Service"
+          applicationName="HeuristiclLabServices"/>
+      </providers>
+    </roleManager>
+
   </system.web>
   <system.serviceModel>
@@ -27,6 +38,7 @@
       <serviceBehaviors>
         <behavior name="HttpServiceBehavior">
+          <serviceAuthorization principalPermissionMode ="UseAspNetRoles"
+                        roleProviderName ="HeuristicLabRoleProvider" />
           <serviceCredentials>
-            
             <userNameAuthentication membershipProviderName="HeuristiclabMemberShipProvider" userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Service.Provider.HeuristicLabUsernamePasswordValidator, Service" />
             <!-- the name and store of the certificate has to be customized for each server to run-->
Index: /branches/HeuristicLab.Services.Authentication Prototype/Service/Services/Administration/AuthorizationManagementService.cs
===================================================================
--- /branches/HeuristicLab.Services.Authentication Prototype/Service/Services/Administration/AuthorizationManagementService.cs	(revision 4020)
+++ /branches/HeuristicLab.Services.Authentication Prototype/Service/Services/Administration/AuthorizationManagementService.cs	(revision 4021)
@@ -3,4 +3,5 @@
 using System.Linq;
 using System.Text;
+using System.Security.Permissions;
 
 namespace Service.Services.Administration {
@@ -8,4 +9,5 @@
     #region IAuthorizationManagementService Member
 
+   
     public void CreateRole(string roleName, bool isPermission) {
       new Service.Provider.HeuristicLabRoleProvider().CreateRole(roleName, isPermission);
Index: /branches/HeuristicLab.Services.Authentication Prototype/Service/Services/Administration/IAuthorizationManagementService.cs
===================================================================
--- /branches/HeuristicLab.Services.Authentication Prototype/Service/Services/Administration/IAuthorizationManagementService.cs	(revision 4020)
+++ /branches/HeuristicLab.Services.Authentication Prototype/Service/Services/Administration/IAuthorizationManagementService.cs	(revision 4021)
@@ -1,7 +1,4 @@
-﻿using System;
-using System.Collections.Generic;
-using System.Linq;
-using System.Text;
-using System.ServiceModel;
+﻿using System.ServiceModel;
+using System.Security.Permissions;
 
 namespace Service.Services.Administration {
@@ -10,4 +7,5 @@
 
     [OperationContract]
+    [PrincipalPermission(SecurityAction.PermitOnly, Role = "Admin")]
     void CreateRole(string roleName, bool isPermission);
 
Index: /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/app.config
===================================================================
--- /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/app.config	(revision 4020)
+++ /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/app.config	(revision 4021)
@@ -3,4 +3,13 @@
   <system.web>
     <compilation debug="true" />
+    <roleManager enabled ="true"
+   defaultProvider ="HeuristicLabRoleProvider" >
+      <providers>
+
+        <add name ="HeuristicLabRoleProvider"
+          type="Service.Provider.HeuristicLabRoleProvider, Service"
+          applicationName="HeuristiclLabServices"/>
+      </providers>
+    </roleManager>
     <membership defaultProvider="HeuristiclabMemberShipProvider" userIsOnlineTimeWindow="15">
       <providers>
@@ -68,6 +77,7 @@
       <serviceBehaviors>
         <behavior name="HttpServiceBehavior">
+          <serviceAuthorization principalPermissionMode ="UseAspNetRoles"
+                        roleProviderName ="HeuristicLabRoleProvider" />
           <serviceCredentials>
-
             <userNameAuthentication membershipProviderName="HeuristiclabMemberShipProvider" userNamePasswordValidationMode="Custom" customUserNamePasswordValidatorType="Service.Provider.HeuristicLabUsernamePasswordValidator, Service" />
             <serviceCertificate findValue="MyServerCert" x509FindType="FindBySubjectName" storeLocation="LocalMachine" storeName="My" />
Index: /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/service/AbstractHeuristicLabServiceTest.cs
===================================================================
--- /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/service/AbstractHeuristicLabServiceTest.cs	(revision 4020)
+++ /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/service/AbstractHeuristicLabServiceTest.cs	(revision 4021)
@@ -20,5 +20,5 @@
 
     [TestCleanup()]
-    public virtual void closeDBConnection() {
+    public override void closeDBConnection() {
       sh.Close();
       base.closeDBConnection();
Index: /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/service/HeuristicLabManagementServiceTest.cs
===================================================================
--- /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/service/HeuristicLabManagementServiceTest.cs	(revision 4020)
+++ /branches/HeuristicLab.Services.Authentication Prototype/UnitTests/service/HeuristicLabManagementServiceTest.cs	(revision 4021)
@@ -5,4 +5,5 @@
 using Microsoft.VisualStudio.TestTools.UnitTesting;
 using System.Web.Security;
+using Service.Provider;
 
 namespace UnitTests.service {
@@ -34,4 +35,7 @@
       provider.CreateUser("testUser", "mypassword", "myMail", "question", "answer", true, null,out status);
       Assert.AreEqual(MembershipCreateStatus.Success, status);
+      HeuristicLabRoleProvider roleProvider = new HeuristicLabRoleProvider();
+      roleProvider.CreateRole("Admin");
+      roleProvider.AddUsersToRoles(new String[1]{"testUser"},new String[1]{"Admin"});
 
       AuthorizationManagementServiceRemote.AuthorizationManagementServiceClient client = new AuthorizationManagementServiceRemote.AuthorizationManagementServiceClient();
@@ -39,4 +43,14 @@
       client.ClientCredentials.UserName.Password = "mypassword";
       client.CreateRole("roleName", true);
+      roleProvider.RemoveUsersFromRoles(new String[1] { "testUser" }, new String[1] { "Admin" });
+      try {
+        client.CreateRole("roleName", true);
+        Assert.Fail();
+      }
+      catch (Exception) {
+        //should throw exception
+      }
+
+
     }
 
