I need to place my app business logic into a WCF service. The service shouldn't be dependent on ASP.NET and there is a lot of data regarding the authenticated user which is frequently used in the business logic hence it's supposed to be cached (probably using a distributed cache). As for authentication - I'm going to use two level authentication:

1. Front-End - forms authentication back-end
2. (WCF Service) - message username authentication.

For both authentications the same custom membership provider is supposed to be used. To cache the authenticated user data, I'm going to implement two service methods:

1) Authenticate - will retrieve the needed data and place it into the cache(where username will be used as a key)
2) SignOut - will remove the data from the cache

Question 1. Is correct to perform authentication that way (in two places) ?

Question 2. Is this caching strategy worth using or should I look at using aspnet compatible service and asp.net session ?

Maybe, these questions are too general. But, anyway I'd like to get any suggestions or recommendations.

Any Idea