title: asp.net Authorizaton being ignored
body: <p>I have an issue when trying to apply the [Authorize] decoration anywhere in my .net core 3.0 MVC app. To preface, I have My services set like so:</p>
  
  <pre><code>        services.AddRouting();
          services.AddOrchardCore().AddMvc();
          services.AddResponseCaching();
          services.AddAuthentication();
          services.AddAuthorization();
          services.AddAntiforgery();
          services.AddDbContextPool&lt;AppDbContext2&gt;(options =&gt; options.UseSqlServer(_config.GetConnectionString("LocalDBConnection")));
          services.AddIdentity&lt;ApplicationUser, IdentityRole&gt;()
          .AddRoleManager&lt;RoleManager&lt;IdentityRole&gt;&gt;()
          .AddEntityFrameworkStores&lt;AppDbContext2&gt;()
          .AddRoles&lt;IdentityRole&gt;()
          .AddDefaultTokenProviders();
  </code></pre>
  
  <p>And I have this controller:</p>
  
  <pre><code>using System;
  using System.Collections.Generic;
  using System.Linq;
  using System.Text;
  using System.Threading.Tasks;
  using Microsoft.AspNetCore.Mvc;
  using Microsoft.AspNetCore.Identity;
  using Microsoft.AspNetCore.Authorization;
  using ModelLibraryModule;
  
  namespace Module1.Controllers
  {
      [Authorize]
      public class HomeController : Controller
      {
          public ActionResult Index()
          {
              return View();
          }
  
  
          [Authorize(Roles="AddUser")]
          public ActionResult UserList()
          {
  
              var a = HttpContext.User;
              var b = a.IsInRole("AddUser");
              var c = User.Claims.ToList();
              var d = User.Identities.ToList();
              return View();
          }
      }
  }
  
  </code></pre>
  
  <p>My problem is that I can access either method in Homecontroller regardless of whether I am logged in or not. All of the test vars show what I should be expecting. IsAuthenticated returns false without logging in, IsInRole() is correct when I am logged in, and User.Claims.ToList() shows all the claims for a logged in user.</p>
  
  <p>But the [Authorize] tag seems to be doing absolutely nothing. I see no indication in the output log that Authorisation is even being attempted. I've tried several fixes at this point but currently this has me stumped. Is there something obvious that I'm missing here?</p>