title: asp.net mvc role authorization not working
body: <p>Following the tutorial here:</p>
  
  <p><a href="http://www.asp.net/mvc/tutorials/authenticating-users-with-windows-authentication-cs" rel="nofollow">http://www.asp.net/mvc/tutorials/authenticating-users-with-windows-authentication-cs</a></p>
  
  <p>I am trying to implement windows authentication and authorization.  </p>
  
  <p>IIS on Localhost is configured to use windows authentication.  Here are the relevant elements from my web.config:</p>
  
  <pre><code>      &lt;authentication mode="Windows"&gt;
  
        &lt;/authentication&gt;
  
        &lt;authorization&gt;
         &lt;deny users="?" /&gt;
        &lt;/authorization&gt;
  </code></pre>
  
  <p>In my controller, I have this:</p>
  
  <pre><code>    [Authorize(Roles = "MY_DOMAIN\\SomeGroup")]
      public ActionResult Index()
      {
          IList&lt;CampusListViewModel&gt; campusList = _campusRepository.List(true);
          return View("Index", campusList);
      }
  </code></pre>
  
  <p>Now, lets say that I set SomeGroup equal to an AD group of which I am a member.  In this case, the authorize attribute appears to work and I am allowed to see the view.  Next, lets say that I set SomeGroup equal to a group of which I am not a member... again, things seem to be working... I am not allowed to see the view.</p>
  
  <p>I know what you are thinking:  "Down-vote this lame question... what more does this loser want from the authorize attribute?"  </p>
  
  <p>The problem is that, in the course of my testing, I removed myself from an AD group which I was previously a member of.  For some reason, I am still able to see the view when I set SomeGroup equal to that group.</p>
  
  <p>Using the IsInRole method of the User object as seen below:</p>
  
  <pre><code>@User.IsInRole("MY_DOMAIN\\GroupINoLongerBelongTo")
  </code></pre>
  
  <p>outputs "TRUE".  So, something, somewhere, still thinks I'm in that AD group.  We have three domain controllers and I've checked each one to verify that I'm not in the group, just in case there was a problem with replication across the controllers and that doesn't seem to be the problem.</p>
  
  <p>What am I missing?  Does IIS cache this sort of thing?  I've tried restarting IIS  and rebooting the server to no avail... any ideas?</p>
  
  <p><strong>UPDATE:</strong>  This is now resolved.  I made both of the changes suggested by @artem below and neither of them seemed to work.  I then turned off my computer in a fit of pique and stomped off to lunch.  When I returned an hour later and powered up my pc, things started working.  So, some combination of @artme's suggestions and a reboot sovlved this.  </p>
  
  <p>I guess the green chile burrito I ate at lunch can't be ruled out either...</p>