You don't have to use EF with RIA Services. Dinesh Kulkarni demonstrated how to implement a DomainService class using NHibernate.

Kulkarni emphasizes that WCF RIA Services is a prescriptive pattern and that they designed it to be DAL agnostic. Sounds like the Ruby philosophy...

For your DomainService implementation you can add an attribute for an update method to declaritively require that the user be in a certain role:

[RequiresAuthentication]
[RequiresRole("Administrator")]
public void UpdateFoo(SomeEntity entity) {
   
}

This is useful if you want end users to be able to query data without yet logging in but then they have to log in to makes updates.

Best practices to use RIA Services effectively:
 
Do:

* require authentication / roles
* use https in IIS
* utilize query composition (filter, sort, page)
* consider custom update
* factor into multiple DomainService classes and libraries, especially for large apps
* handle errors server-side
* use declarative validation

Don't:

* deploy with anonymous access
* expose non-essential entities/operations
* allow free-form access to data (malicious user problem)
* don't throw everything into one big DomainService class

Unfortunately we ran out of time and he was unable to demonstrate the NHibernate plumbing.