title: using windows authentication with active directory groups as roles
body: <p>I've read several questions on this topic, 
  such as <a href="https://stackoverflow.com/questions/5833059/authenticate-user-using-active-directory-windows-authentication-in-ms-access-200">here</a>, <a href="https://stackoverflow.com/questions/13398079/getting-user-roles-groups-from-active-directory-mvc3">here</a>, <a href="https://stackoverflow.com/questions/23610/windows-active-directory-user-groups">here</a> and <a href="https://stackoverflow.com/questions/209242/asp-net-role-based-authentication-using-security-groups-in-active-directory">here</a>;
  but none have provided a working solution in my case.</p>
  
  <p><strong>What I want to do:</strong></p>
  
  <p>Implement Windows authentication for a web app that is only used by our own employees.  This way they should not need to log into the app, but already be authenticated by way of having logged into windows.</p>
  
  <p>Also, I need to restrict certain areas of the app, based on Active Directory Security Groups that the user may be assigned to.</p>
  
  <p>So I want to be able to decorate Controllers / Actions with</p>
  
  <pre><code>[Authorize(Roles="SomeRole")]
  </code></pre>
  
  <p><strong>What I've tried:</strong></p>
  
  <p>I have </p>
  
  <pre><code>&lt;authentication mode="Windows" /&gt;
  </code></pre>
  
  <p>in my web.config.  And I have added several permutations of a <code>&lt;roleManager&gt;</code> as found in some of the posts linked to above.  Currently I have this role manager</p>
  
  <pre><code>&lt;roleManager defaultProvider="WindowsProvider"
    enabled="true"
    cacheRolesInCookie="false"&gt;
        &lt;providers&gt;
          &lt;add
            name="WindowsProvider"
            type="System.Web.Security.WindowsTokenRoleProvider" /&gt;
        &lt;/providers&gt;
      &lt;/roleManager&gt;
  </code></pre>
  
  <p>as found in <a href="http://msdn.microsoft.com/en-us/library/system.web.security.windowstokenroleprovider.aspx" rel="noreferrer">this</a> post.</p>
  
  <p>As it is, if I decorate a controller with <code>[Authorize]</code>, I can access it fine.</p>
  
  <p><strong>However:</strong></p>
  
  <p>I can see in my user settings on the network, that I am part of a AD security group called "IT".  But if I decorate the same controller with <code>[Authorize(Roles="IT")]</code> I get the blank screen that is is served by the asp.net development server for a 401 not authorized.  <strong>This is unexpected.</strong>  I would think that I should be able to view the page as I am logged in to windows and am part of the group "IT".</p>
  
  <p>Most everything I am finding on this topic make it sound very simple to accomplish what I'm trying to do, but I am clearly missing something here.</p>