title: SimpleMembership: AuthorizeAttribute and User.IsInRole not working
body: <p>I've been racking my brain over this for the past week, and none of the answers I've found here or elsewhere seem to be doing anything. I have an ASP.NET MVC5 application that uses SimpleMembership. I have a controller called OrganisationsController that has the following attribute:</p>
  
  <pre><code>[Authorize(Roles = "Administrator")]
  </code></pre>
  
  <p>I've checked the database and the user I'm logging in with is indeed in the "Administrator" role. However, neither the Authorize attribute nor User.IsInRole() return "true" for this role.</p>
  
  <p>In <a href="https://stackoverflow.com/questions/18807806/authorize-attribute-not-working-with-roles">Authorize attribute not working with roles</a> it is suggested that </p>
  
  <blockquote>
    <p>The AuthorizeAttribute calls the IsInRole method on the IPrincipal instance stored in HttpContext.User. By default IPrincipal has no roles, and in this case IsInRole will always return false. This is why access to your action is denied.</p>
  </blockquote>
  
  <p>I've used the following code as suggested in that answer, but authTicket.UserData remains empty.</p>
  
  <pre><code>protected void Application_AuthenticateRequest(Object sender, EventArgs e)
  {
      HttpCookie authCookie = Context.Request.Cookies[FormsAuthentication.FormsCookieName];
      if (authCookie != null)
      {
        FormsAuthenticationTicket authTicket = FormsAuthentication.Decrypt(authCookie.Value);
        string[] roles = authTicket.UserData.Split(',');
        GenericPrincipal userPrincipal = new GenericPrincipal(new GenericIdentity(authTicket.Name), roles);
        Context.User = userPrincipal;
      }
  }
  </code></pre>
  
  <p>I can't figure out what's going wrong. Why can I log in, but can't any of the roles be found?</p>
  
  <p>Here's some relevant parts of the web.config:</p>
  
  <pre><code> &lt;roleManager enabled="true" defaultProvider="SimpleRoleProvider"&gt;
        &lt;providers&gt;
          &lt;add name="SimpleRoleProvider" type="WebMatrix.WebData.SimpleRoleProvider, WebMatrix.WebData" /&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
  
  
      &lt;membership defaultProvider="SimpleMembershipProvider"&gt;
        &lt;providers&gt;
          &lt;add name="SimpleMembershipProvider" type="WebMatrix.WebData.SimpleMembershipProvider, WebMatrix.WebData" /&gt;
        &lt;/providers&gt;
      &lt;/membership&gt;
  
      &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="~/Account/Login" timeout="2880" cookieless="UseCookies" /&gt;
      &lt;/authentication&gt;
  </code></pre>
  
  <p>and this is the InitializeSimpleMembershipAttribute I've defined:</p>
  
  <pre><code> [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, AllowMultiple = false, Inherited = true)]
  public sealed class InitializeSimpleMembershipAttribute : ActionFilterAttribute
  {
      private static SimpleMembershipInitializer _initializer;
      private static object _initializerLock = new object();
      private static bool _isInitialized;
  
      public override void OnActionExecuting(ActionExecutingContext filterContext)
      {
          // Ensure ASP.NET Simple Membership is initialized only once per app start
          LazyInitializer.EnsureInitialized(ref _initializer, ref _isInitialized, ref _initializerLock);
      }
  
      private class SimpleMembershipInitializer
      {
          public SimpleMembershipInitializer()
          {
              Database.SetInitializer&lt;UsersContext&gt;(null);
  
              try
              {
                  using (var context = new UsersContext())
                  {
                      if (!context.Database.Exists())
                      {
                          // Create the SimpleMembership database without Entity Framework migration schema
                          ((IObjectContextAdapter)context).ObjectContext.CreateDatabase();
                      }
                  }
  
                  if (!WebSecurity.Initialized)
                  {
                      WebSecurity.InitializeDatabaseConnection("VerhaalLokaalDbContext", "UserProfile", "UserId", "UserName", autoCreateTables: true);
                  }
              }
              catch (Exception ex)
              {
                  throw new InvalidOperationException("The ASP.NET Simple Membership database could not be initialized. For more information, please see http://go.microsoft.com/fwlink/?LinkId=256588", ex);
              }
          }
      }
  }
  </code></pre>
  
  <p>The InitializeSimpleMembershipAttribute is only set on the AccountController.</p>
  
  <p>What's exactly is going on here? Why can't the roles, which are defined and tied to users in the database, be found?</p>