title: MVC 4.0 FormsAuthentication and AuthorizeAttribute in custom authorization
body: <p>I am using <code>MVC4</code> and I'm trying to modify the allocation procedure for authenticating a user and assign roles to users. Everything works fine for the attribute <code>[Authorize (Users = "adminadmin")]</code>, but the <code>[Authorize (Roles = "Admin")]</code> every time there is a login page and lack of access.</p>
  
  <p>Global.asax.cs:</p>
  
  <pre><code>protected void Application_AuthenticateRequest(object sender, EventArgs e)
          {
              // look if any security information exists for this request
              if (HttpContext.Current.User != null)
              {
                  // see if this user is authenticated, any authenticated cookie (ticket) exists for this user
                  if (HttpContext.Current.User.Identity.IsAuthenticated)
                  {
                      // see if the authentication is done using FormsAuthentication
                      if (HttpContext.Current.User.Identity is FormsIdentity)
                      {
                          // Get the roles stored for this request from the ticket
                          // get the identity of the user
                          FormsIdentity identity = (FormsIdentity)HttpContext.Current.User.Identity;
                          //Get the form authentication ticket of the user
                          FormsAuthenticationTicket ticket = identity.Ticket;
                          //Get the roles stored as UserData into ticket
                          List&lt;string&gt; roles = new List&lt;string&gt;();
                          if (identity.Name == "adminadmin")
                              roles.Add("Admin");
                          //Create general prrincipal and assign it to current request
  
                          HttpContext.Current.User = new System.Security.Principal.GenericPrincipal(identity, roles.ToArray());
                      }
                  }
              }
          }
  </code></pre>
  
  <p>AccountController:</p>
  
  <pre><code>[InitializeSimpleMembership]
  public class AccountController : Controller
  {
  public ActionResult Login()
  {
      return View();
  }
  
  [HttpPost]
  public ActionResult Login(LoginModel model, string returnUrl)
  {
      // Lets first check if the Model is valid or not
      if (ModelState.IsValid)
      {
              string username = model.UserName;
              string password = model.Password;
  
              bool userValid = username == password ? true : false;
  
              // User is valid
              if (userValid)
              {
  
                  FormsAuthentication.SetAuthCookie(username, false);
                  if (Url.IsLocalUrl(returnUrl) &amp;&amp; returnUrl.Length &gt; 1 &amp;&amp; returnUrl.StartsWith("/")
                      &amp;&amp; !returnUrl.StartsWith("//") &amp;&amp; !returnUrl.StartsWith("/\\"))
                  {
                      return Redirect(returnUrl);
                  }
                  else
                  {
                      return RedirectToAction("Index", "Home");
                  }
              }
              else
              {
                  ModelState.AddModelError("", "The user name or password provided is incorrect.");
              }
      }
  
      // If we got this far, something failed, redisplay form
      return View(model);
  }
  
  public ActionResult LogOff()
  {
      FormsAuthentication.SignOut();
  
      return RedirectToAction("Index", "Home");
  }
  </code></pre>
  
  <p>}</p>
  
  <p>HomeController.cs:</p>
  
  <pre><code> public class HomeController : Controller
      {
          [AllowAnonymous]
          public ActionResult Index()
          {
              ViewBag.Message = "Modify this template to jump-start your ASP.NET MVC application.";
  
              return View();
          }
  
          [Authorize]
          public ActionResult About()
          {
              ViewBag.Message = "Your app description page.";
  
              return View();
          }
  
          [Authorize(Roles = "Admin")]
          public ActionResult Contact()
          {
              ViewBag.Message = "Your contact page.";
  
              return View();
          }
      }
  </code></pre>
  
  <p>Web.config:</p>
  
  <pre><code>(...)
      &lt;authentication mode="Forms"&gt;
        &lt;forms loginUrl="~/Account/Login" timeout="2880"/&gt;
      &lt;/authentication&gt;
  (...)
  </code></pre>