see http://bertcraven.wordpress.com/2011/03/27/implementing-a-rest-ful-service-using-openrasta-and-oauth-wrap-with-windows-azure-appfabric-acs/

ClaimsAuthorizingInterceptor.cs

namespace AzureClaimsAuthenticator
{
	using System.Linq;

	using OpenRasta.Authentication;
	using OpenRasta.DI;
	using OpenRasta.OperationModel.Interceptors;
	using OpenRasta.Web;

	public class ClaimsAuthorizingInterceptor : OperationInterceptor
	{
		readonly IDependencyResolver resolver;

		public ClaimsAuthorizingInterceptor(IDependencyResolver resolver)
		{
			this.resolver = resolver;
		}

		public override bool BeforeExecute(OpenRasta.OperationModel.IOperation operation)
		{
			var attribute = operation.FindAttribute<RequiresClaimsAttribute>();
			if (attribute != null)
			{
				var context = resolver.Resolve<ICommunicationContext>();				
				if (!CheckAccess(context))
				{
					context.OperationResult = new OperationResult.Unauthorized();					
					return false;
				}				
			}
			return base.BeforeExecute(operation);
		}

		protected static bool CheckAccess(ICommunicationContext context)
		{
			var operations = context.PipelineData.Operations.ToList();
			var method = operations[0];
			var attribute = method.FindAttribute<RequiresClaimsAttribute>();
			if (attribute != null)
			{
				return context.User.IsInRole(string.Format("{0}:{1}", attribute.ClaimType, attribute.ClaimValue));
			}
			return true;
		}
	}
}