title: MVC 5 custom AuthorizeAttribute
body: <p>I want to implement custom <code>AuthorizeAttribute</code>. </p>
  
  <p>I have custom user:</p>
  
  <pre><code>    public class MyUser : IPrincipal
      {
          public List&lt;string&gt; Roles { get; set; }
          public IIdentity Identity{ get; set; } 
          public bool IsInRole(string role){ return Roles.Contains(role); }
      }
  </code></pre>
  
  <p>In <code>global.asax</code></p>
  
  <pre><code>    protected void Session_Start(object sender, EventArgs e)
      {
           MyUser user = new MyUser();
           user.Identity = User.Identity;
           user.Roles = new List&lt;string&gt;();
           user.Roles.Add("MyRole");//I will get them from AD
           HttpContext.Current.User = user;
      }
  </code></pre>
  
  <p>and the Attribute</p>
  
  <pre><code>    public class AuthorizeADAttribute : AuthorizeAttribute
      {
          public string Roles { get; set; }
          protected override bool AuthorizeCore(HttpContextBase httpContext)
          {
              MyUser user = (MyUser)httpContext.User;//User is not MyUser
              if (user.Roles.Contains(Roles))
              {
                  return true;
              }
              return false;
          }
  
          protected override void HandleUnauthorizedRequest(
          AuthorizationContext filterContext)
          {
              ...
          }
      }
  </code></pre>
  
  <p>The problem is that <code>httpContext.User</code> returns <code>System.Security.Claims.ClaimsPrincipal</code>.
  Why that happens and how can I access my user from <code>session_start</code> ?</p>