title: Asp.Net MVC 4 User is authenticated even if not authorized
body: <p>I am working in my first MVC project and i am having troubles with authentication.
  I have a login page that correctly validates the user by my active directory. But, even authenticated not all users are authorized to access the system, so I use a section in web.config to check if user have permissions. Something like:</p>
  
  <pre><code>&lt;authorization&gt;
     &lt;allow users="john,mary,paul,bill,jane,anna" /&gt;
     &lt;deny users="*" /&gt;
  &lt;/authorization&gt;
  </code></pre>
  
  <p>It works fine and the user always is redirected to login if doesn't have permission.
  BUT, when I check if user is Authenticated, the result is always true. And, in login page, I want to check if I must show a message to logged AND authorized users. Something like:</p>
  
  <pre><code>@if (User.Identity.IsAuthenticated &amp;&amp; User.Identity.IsAuthorized)
  {
     @Html.Partial("_Menu");   
  }
  </code></pre>
  
  <p>So... How I do it?</p>