tags:

views:

1324

answers:

2

I'm working on adding authorization to an ASP.NET MVC App and have run into a road block. I was finally able to get our custom membership provider wired up and get authentication working for the App. Now, as expected, if I add the [Authorize] attribute to my controllers, the user must be authenticated to view the page. I have also successfully tested [Authorize(Users="{userName}")] which also works to restrict the page to that specific user.

The problem is that [Authorize(Roles="{RoleName}")] does not seem to work as I'm expecting. If I add that attribute to a controller, anytime I try to access the corresponding page, I am redirected to our login page. This is what I would expect to have happen if the user does not have the required role, but it is happening even if the user has that role. I have checked both User.IsInRole("{roleName}") and HttpContext.Current.User.IsInRole("{roleName}") in a View, a Controller and a Helper method and this always returns 'False'.

I have verified that the users I am working with have the roles I am trying to authorize against. I have also tested these users in a WebForms App that restricts page access by the same roles and it works fine. I figure that I have something setup wrong somewhere or am missing something simple, but after searching all morning, I haven't found anything that has gotten me any closer to the solution, so I'm hoping someone here can help me out.

+3  A: 

First : use a profiler and when executing the HttpContext.Current.User.IsInRole("{roleName}") line, check what the sql query is.

If it's not making a query then you probably have cacheRolesInCookie="true" and IsInRole will be checking the FormsAuthenticationTicket for UserData. Be sure that when you create the FormsAuthenticationTicket you set the userdata parameter to a comma delimited string with the roles of the user.

sirrocco
Thanks, this didn't solve the problem, but it did lead me down a road that eventually did. It turns out that there were some extra config settings that are needed to get out role provider fully working that no one bothered to tell me about. Once I stumbled upon those, everything 'magically' started to work.
Hamman359
A: 

Try clearing out your browser cookie cache. I spent a while banging my head on a similar problem, and clearing out my cookies solved the problem.

Ben Robbins