I have a WCF service hosted in a Claims-enabled SharePoint 2010 webapp.
Using wsHttpBinding I can get a console client to use Windows (Kerberos) authentication against the service. Within the service, I impersonate the calling user, and try to open an SPSite instance.
As soon as I call something on the SPSite object, such as SPSite.RootWeb.Title, the service silently crashes. The ULS log yields an unknown SPRequest error, with an id implying a permission issue.
The user is a site collection administrator, so those rights aren't the problem here.
How can I get this running? What's the best practice for WCF service auth in Claims-enabled SharePoint 2010?