title: Impersonate a user in a standard ASP.NET MVC installation template
body: <p>I have setup a standard ASP.NET MVC site with normal authentication. I have added roles, so new users get a specific role.</p>
  
  <p>Now, I want to be able to impersonate a user.</p>
  
  <p><strong>Impersonating advice</strong></p>
  
  <p>Impersonating, when I search around, comes the following way:</p>
  
  <pre><code>     FormsAuthentication.SetAuthCookie(user.UserName, false);
  </code></pre>
  
  <p>This doesn't work by default, as you have to do two things:</p>
  
  <p>1:</p>
  
  <p>Enable forms authentication:</p>
  
  <pre><code> &lt;system.web&gt;
      &lt;authentication mode="Forms" /&gt;
    &lt;/system.web&gt;
  </code></pre>
  
  <p>2:</p>
  
  <p>Disable the module:</p>
  
  <pre><code>&lt;system.webServer&gt;
      &lt;modules&gt;
        &lt;!--&lt;remove name="FormsAuthentication" /&gt;--&gt;
      &lt;/modules&gt;
      &lt;staticContent&gt;
  </code></pre>
  
  <p><strong>The challenge</strong></p>
  
  <p>However, doing this leaves a couple of challenges.</p>
  
  <ol>
  <li>When you impersonate, you cannot log out. This is easily fixed by
  adding the following in LogOut:   <code>FormsAuthentication.SignOut();</code></li>
  <li>The  <code>User.IsInRole(Constants.Roles.Creditor);</code> stops working, so
  we cannot check if user in a role</li>
  </ol>
  
  <p><strong>What to do?</strong></p>
  
  <p>This COULD boil down to me - apparently - not fully understanding the membership framework despite trying. However, how do you get impersonate to work here?</p>
  
  <p>I have no explicit reason to use "Forms" authentication, and the only reason I started on this path is Impersonating. So I see I have two obvious directions:</p>
  
  <ul>
  <li>A) Implement impersonation in a different way, so I don't touch my
  web.config to use forms </li>
  <li>B) Fix the role problem in forms</li>
  </ul>
  
  <p>Any help here? :-)</p>