title: How are ASP.NET Roles used with Authorization?
body: <p>I'm using ASP.NET Core and hosting what is basically the default template with Windows Authentication enabled. I'm hosting this on a dedicated IIS server, and have verified the app is receiving correct information from AD and it correctly authenticates my session.</p>
  
  <p>I feel like I'm trying to do something very simple. If the user is in the security group (from AD) "Admin" they are able to access a specific function. If they aren't in that group they do not get access.</p>
  
  <p>I slapped on the [Authorize] attribute to the service</p>
  
  <pre><code>(in ConfigureServices)
  services.AddAuthentication(IISDefaults.AuthenticationScheme);
  (in Configure)
  app.UseAuthorization();
  
  (in service)
  [Authorize]
  public class SiteService
      {
          private readonly string _route;
          private readonly HttpClient _httpClient;
  
          public SiteService(HttpClient httpClient)
          {
              _httpClient = httpClient;
              _route = httpClient.BaseAddress.AbsoluteUri;
          }
  
          public async Task&lt;IEnumerable&lt;Site&gt;&gt; GetSites()
          {
  
          }
     }
  </code></pre>
  
  <p>I can see in the logs that accessing the service gives me Domain/User. I then looked up the MS Docs here: <a href="https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles?view=aspnetcore-3.1" rel="nofollow noreferrer">https://docs.microsoft.com/en-us/aspnet/core/security/authorization/roles?view=aspnetcore-3.1</a></p>
  
  <p>And slapped on [Authorize(Roles = "Admin"). That worked. I then switched "Admin" with "sldkfjslksdlfkj". Nothing changed...I can still access the service. </p>
  
  <p>Why is the Roles="x" check not working? How can I enable a relatively simple check to AD for a Security Group?</p>