Design recommendation on using impersonation for multi tiered applications

As a common design recommendation, the further from the client, the less significant its identity should be. In a layered architecture, each layer should run underneath its own identity, authenticate its direct callers, and implicitly trust its calling layer to authenticate its original callers.

See “Trusted Subsystem Pattern” (Patterns & Practices)

The Web service acts as a trusted subsystem to access additional resources. It uses its own credentials instead of the user's credentials to access the resource. The Web service must perform appropriate authentication and authorization of all requests that enter the subsystem. Remote resources should also be able to verify that the midstream caller is a trusted subsystem and not an upstream user of the application that is trying to bypass access to the trusted subsystem.

See also:

http://blogs.msdn.com/securitytools/archive/2009/12/30/wcf-security-impersonation.aspx