title: Forms Authentication User.IsInRole(), Authorize attribute - not working on production server
body: <p>sorry for my poor english.</p>
  
  <p>The Facts:</p>
  
  <ul>
  <li>ASP.NET MVC3</li>
  <li>EF5.</li>
  <li>FormAuthentication</li>
  <li>roleManager disabled</li>
  </ul>
  
  <p>My implementation follows <a href="https://stackoverflow.com/questions/2282260/can-i-make-use-of-user-isinrole-without-using-membership">this concept</a>! + <strong>See Code below</strong></p>
  
  <p>Everything works well on</p>
  
  <ul>
  <li>a local Server IIS Win7 (WebDeploy)</li>
  <li>&amp; my old Windows Server 2008</li>
  </ul>
  
  <p>until I deployed the App to a</p>
  
  <ul>
  <li>new Windows Server 2008 Web</li>
  </ul>
  
  <p>I have issues with the roles </p>
  
  <ul>
  <li><strong>isInRole()</strong> and the </li>
  <li><strong>[Authorize(Roles = "member,admin")]</strong> Attribute </li>
  </ul>
  
  <p>is not working properly.</p>
  
  <p>Here are some code snippets + debug output</p>
  
  <p><strong>Helper Class</strong></p>
  
  <pre><code>public static class UserHelper
  {
          public static bool IsAdmin(this ViewUserControl pg)
          {
              // @TODO Delete (Glimpse output)
  
              string s = HttpContext.Current.User.IsInRole("admin") ? "UserHelper.IsAdmin()  IsInRole() == true" : "UserHelper.IsAdmin() Application_AuthenticateRequest  IsInRole() == false";
              string b = pg.Page.User.IsInRole("admin") ? "UserHelper.IsAdmin()  IsInRole() == true" : "UserHelper.IsAdmin() Application_AuthenticateRequest  IsInRole() == false";
  
              Trace.Write(s);
              Trace.Write(b);           
  
              var id = HttpContext.Current.User.Identity as FormsIdentity;
              Trace.Write("UserHelper.isAdmin(): UserData"+id.Ticket.UserData);
  
              // ============================
  
              return HttpContext.Current.User.IsInRole("admin");
          }
  }
  </code></pre>
  
  <p><strong>Global.asax.cs</strong></p>
  
  <pre><code>public class MvcApplication : HttpApplication
  {
      protected void Application_AuthenticateRequest(Object sender, EventArgs e)
      {
          if (HttpContext.Current.User == null) return;
          if (!HttpContext.Current.User.Identity.IsAuthenticated) return;
          if (!(HttpContext.Current.User.Identity is FormsIdentity)) return;
  
          var id = HttpContext.Current.User.Identity as FormsIdentity;
          var userState = new UserState();
          userState.FromString(id.Ticket.UserData);
          HttpContext.Current.User = new GenericPrincipal(id, userState.Rollen.Split(new[] { ',' }));
  
          // @TODO Delete (Glimpse output)
          Trace.Write("Global.asax.cs -&gt; Application_AuthenticateRequest Userdata: "+id.Ticket.UserData);
          string s = HttpContext.Current.User.IsInRole("admin") ? "Global.asax.cs -&gt; Application_AuthenticateRequest IsInRole() == true" : "Global.asax.cs -&gt; Application_AuthenticateRequest IsInRole() == false";
          Trace.Write(s);
      }
  </code></pre>
  
  <p><strong>AccountController.cs</strong> (Example)</p>
  
  <pre><code>   [Authorize(Roles = "member,admin")]
     [UserActive]
     public ActionResult ChangePassword()
     {
       return View();
     }
  </code></pre>
  
  <p><strong>FormAuthService.cs</strong></p>
  
  <pre><code>public class FormAuthService : IFormsAuthentication
  {
      public void Login(string userName, bool createPersistentCookie, IEnumerable&lt;string&gt; roles, int? userID = null)
      {
          var str = string.Join(",", roles);
  
          var userData = new UserState
          {
              Benutzername = userName,
              ID = userID.HasValue ? userID.Value : 0,
              Rollen = str,
              IsAdmin = str.Split(',').Contains("admin")
          };
  
          var authTicket = new FormsAuthenticationTicket(
              1,
              userName,
              DateTime.Now,
              DateTime.Now.AddDays(30),
              createPersistentCookie,
              userData.ToString(),
              "/"
          );
  
          var cookie = new HttpCookie(FormsAuthentication.FormsCookieName, FormsAuthentication.Encrypt(authTicket));
  
          if (authTicket.IsPersistent)
              cookie.Expires = authTicket.Expiration;
  
          HttpContext.Current.Response.Cookies.Add(cookie);
      }
  }
  </code></pre>
  
  <p>I was debugging my code with Glimpse.
  What I'm trying to achieve is the first screenshot...</p>
  
  <p>In my <strong>UserHelper Class</strong> and all other Classes with the Attribute <em>[Authorize]</em>
  it works <em>locally</em> with this Setup.</p>
  
  <p>But when I deploy the Application to my Remote IIS 
  it doesn't recognize that I'm logged in as admin (I'm logged in but the roles aren't working). You can see, in the second screenshot the UserData with "admin" is there but the IsInRole Method fails....</p>
  
  <p>Screenshots:</p>
  
  <p><strong>localhost</strong>
  <a href="http://s13.postimg.org/o9uqhlv6v/wi_local_glimpse_works.png" rel="nofollow noreferrer">http://s13.postimg.org/o9uqhlv6v/wi_local_glimpse_works.png</a></p>
  
  <p><strong>Remote Server</strong>
  <a href="http://s9.postimg.org/pcavzvczj/wi_local_glimpse_works23.png" rel="nofollow noreferrer">http://s9.postimg.org/pcavzvczj/wi_local_glimpse_works23.png</a></p>
  
  <p>What I'm missing? Anyone experienced the same problem?</p>