After reading these three articles, you have all the information required to implement a flexible and robust security infrastructure in your .NET applications.
As you can see, there is still a degree of roughness on some implementation details unless you adopt the ASP.NET runtime as the remote invocation protocol of choice.
The upcoming next version of .NET will bring a unified messaging and object invocation programming model (code name Indigo) merging the three different remote technologies (ASP.NET/Web services, .NET remoting, and enterprise services) that are currently available via three distinct sets of APIs.