title: ASP.NET Web Api with Role based authorization
body: <p>I am using Web API 2 with OWIN token based authentication. Only thing that is not working is authorization based on roles.</p>
  
  <p>In my implementation of AuthorizationServerProvider.GrantResourceOwnerCredentials this is how i assign roles:</p>
  
  <pre><code>identity.AddClaim(client.ApplicationType == ApplicationTypes.WebClient
              ? new Claim(ClaimTypes.Role, "user")
              : new Claim(ClaimTypes.Role, "admin"));
  </code></pre>
  
  <p>But in the Controller using [Authenticate(Roles="user")] just returns a Authorization denied message to the client. I checked the variables and this is whats inside 
  <a href="https://i.stack.imgur.com/cznks.png" rel="noreferrer"><img src="https://i.stack.imgur.com/cznks.png" alt="enter image description here"></a></p>
  
  <p>So the role seems to be there, but user.Claims is empty and IsInRole("user") also returns negative.</p>
  
  <p>I found several questions here on stackoverflow and logic-wise i don't see what i missed. Only thing that comes to my mind is overwriting the Authorize Command but this is kind of needless as role based authorization seems to be integrated already...</p>
  
  <p>EDIT: This is what my workig method looks like:</p>
  
  <pre><code>public override async Task GrantResourceOwnerCredentials(OAuthGrantResourceOwnerCredentialsContext context)
  {
      var allowedOrigin = context.OwinContext.Get&lt;string&gt;("as:clientAllowedOrigin") ?? "*";
          context.OwinContext.Response.Headers.Add("Access-Control-Allow-Origin", new[] { allowedOrigin });
  
      Client client;
      using (var repo = new AuthRepository())
      {
          client = repo.FindClient(context.ClientId);
          if (client.ApplicationType != ApplicationTypes.Service)
          {
              var user = await repo.FindUser(context.UserName, context.Password);
  
              if (user == null)
              {
                  context.SetError("invalid_grant", "The user name or password is incorrect." + context.UserName);
                  return;
              }
          }
  }
  </code></pre>