title: ASP.NET Core 3.0 Role Based Authorization not working
body: <p>I have an ASP.NET Core 3.0 app. I am using Role-Based Authorization. My Startup.cs looks like this:</p>
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddRazorPages();
      services.Configure&lt;CookiePolicyOptions&gt;(options =&gt;
      {
          options.CheckConsentNeeded = context =&gt; true;
          options.MinimumSameSitePolicy = SameSiteMode.None;
      });
  
      services.AddAuthentication().AddCookie();
      services.AddAuthorization(options =&gt;
      {
          options.AddPolicy(&quot;Admin&quot;, authBuilder =&gt; { authBuilder.RequireRole(&quot;Admin&quot;); });
      });
      services.AddIdentity&lt;SiteUser, IdentityRole&gt;(x =&gt;
      {
          x.Lockout.AllowedForNewUsers = true;
          x.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(2);
          x.Lockout.MaxFailedAccessAttempts = 3;
          x.Password.RequireNonAlphanumeric = true;
          x.Password.RequireUppercase = true;
      }).AddEntityFrameworkStores&lt;SiteDbContext&gt;();
      services.AddDbContext&lt;SiteDbContext&gt;(dbContextOptionBuilder =&gt;
          dbContextOptionBuilder.UseLoggerFactory(ConsoleFactory)
              .UseSqlServer(Configuration.GetConnectionString(ConfigurationSettings.LocalDbKeyName)));
  }
  
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
      }
      else
      {
          app.UseExceptionHandler(&quot;/Error/500&quot;);
          app.UseStatusCodePagesWithReExecute(&quot;/Error/{0}&quot;);
          app.UseHsts();
      }
  
      app.UseHttpsRedirection();
      app.UseStaticFiles();
      app.UseCookiePolicy();
      app.UseForwardedHeaders(new ForwardedHeadersOptions
      {
          ForwardedHeaders = ForwardedHeaders.XForwardedFor | ForwardedHeaders.XForwardedProto
      });
      app.UseAuthentication();
      app.UseAuthorization();
      app.UseRouting();
      app.UseEndpoints(endpoints =&gt;
      {
          endpoints.MapControllerRoute(&quot;default&quot;, &quot;{controller=Home}/{action=Index}/{id?}&quot;);
          endpoints.MapControllers();
      });
  </code></pre>
  <p>In my Controller class, I have appropriate Authorize attribute like so,</p>
  <pre><code>[Authorize(Roles = &quot;Admin&quot;)]
  public ActionResult Index()
  {
      var users= getSomeUsers();
      return View(users);        
  }
  </code></pre>
  <p>There are 2 roles in the AspNetRoles Table ie. Admin, and User. However, a user account without the admin role can access the Index action method. It is allowing any authenticated user to access the page and not limiting access to a user who possesses the right role that is the Admin role. What am I missing?</p>