title: Can I use Forms Authentication to authorise against AD groups?
body: <p>I am attempting to authorise users against Active Directory in my ASP .NET MVC3 web application.  Not only do I want force the user to login and authorise that against the users in the directory, but I also want to authorise users against the groups they are in, along the lines of this:</p>
  
  <pre><code>[Authorize(Roles = @"DOMAIN\Group")]
  </code></pre>
  
  <p>Every example I'm seeing does it for Windows authentication.  I am using Forms authentication.  The important parts of my Web.config are as follows:</p>
  
  <pre><code>&lt;add name="ADConnectionString" connectionString="LDAP://blahblahblah" /&gt;
  
  &lt;authentication mode="Forms"&gt;
    &lt;forms name="AD" loginUrl="~/Account/LogOn" /&gt;
  &lt;/authentication&gt;
  
  &lt;membership defaultProvider="ADMembershipProvider"&gt;
    &lt;providers&gt;
      &lt;clear /&gt;
      &lt;add name="ADMembershipProvider" 
           type="System.Web.Security.ActiveDirectoryMembershipProvider" 
           connectionStringName="ADConnectionString"
           attributeMapUsername="sAMAccountName" /&gt;
    &lt;/providers&gt;
  &lt;/membership&gt;
  
  &lt;roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider"&gt;
    &lt;providers&gt;
      &lt;clear /&gt;
      &lt;add name="AspNetWindowsTokenRoleProvider"
           type="System.Web.Security.WindowsTokenRoleProvider"
      /&gt;
    &lt;/providers&gt;
  &lt;/roleManager&gt;
  </code></pre>
  
  <p>I currently get an error that says</p>
  
  <blockquote>
    <p>Method is only supported if the user name parameter matches the user
    name in the current Windows Identity.</p>
  </blockquote>
  
  <p>Is it possible to do this using Forms authentication and how should I configure my app?</p>