HttpContext.Current.User.IsInRole(roleName) always returns false
asp.net-mvc
Solution
First : use a profiler and when executing the HttpContext.Current.User.IsInRole("{roleName}") line, check what the sql query is.
If it's not making a query then you probably have cacheRolesInCookie="true" and IsInRole will be checking the FormsAuthenticationTicket for UserData. Be sure that when you create the FormsAuthenticationTicket you set the userdata parameter to a comma delimited string with the roles of the user.
Problem
I'm working on adding authorization to an ASP.NET MVC App and have run into a road block. I was finally able to get our custom membership provider wired up and get authentication working for the App. Now, as expected, if I add the [Authorize] attribute to my controllers, the user must be authenticated to view the page. I have also successfully tested [Authorize(Users="{userName}")] which also works to restrict the page to that specific user. The problem is that [Authorize(Roles="{RoleName}")] does not seem to work as I'm expecting. If I add that attribute to a controller, anytime I try to access the corresponding page, I am redirected to our login page. This is what I would expect to have happen if the user does not have the required role, but it is happening even if the user has that role. I have checked both User.IsInRole("{roleName}") and HttpContext.Current.User.IsInRole("{roleName}") in a View, a Controller and a Helper method and this always returns 'False'. I have verified that the users I am working with have the roles I am trying to authorize against. I have also tested these users in a WebForms App that restricts page access by the same roles and it works fine. I figure that I have something setup wrong somewhere or am missing something simple, but after searching all morning, I haven't found anything that has gotten me any closer to the solution, so I'm hoping someone here can help me out.