Roles not working (not persisting?)

Question

User-444351719 posted

So I'm working on essentially a legacy app.  I've built a log in page which seems to work fine, code is:

 if (Membership.ValidateUser(nameTest, passwordLogIn.Text))
                {

                    if (Roles.IsUserInRole(nameTest, "Admin"))
                       
                     Response.Redirect("/admin.aspx");
                    else if (Roles.IsUserInRole(nameTest, "Manager"))
                        Response.Redirect("/admin.aspx");
                    else if (Roles.IsUserInRole(nameTest, "User"))
                        Response.Redirect("/mydonations.aspx");
                }

And then in the admin page I test for roles as follows:

 protected void Page_Load(object sender, EventArgs e)
        {
            if (!IsPostBack)
            {
                detailsPlaceholder.Visible = false;
                createnewVehiclePlaceholder.Visible = false;
               
            }
          if (!(User.IsInRole("Admin") || (User.IsInRole("Manager"))))  
            
            {
               Response.Redirect("/Default.aspx");
               
            }
           

        }

Which fails no matter what I try, and as far as I can see the roles are always 0.  Here's my web.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <configSections></configSections>
  <connectionStrings>
    <add name="ApplicationServices" connectionString="Data Source=laptop;Initial Catalog=CAA;Integrated Security=True" />
    
    <add name="CAAConnectionString" connectionString="Data Source=laptop;Initial Catalog=CAA;Integrated Security=True" providerName="System.Data.SqlClient" />
  <add name="CAAEntities" connectionString="metadata=res://*/CAADataEntity.csdl|res://*/CAADataEntity.ssdl|res://*/CAADataEntity.msl;provider=System.Data.SqlClient;provider connection string=&quot;data source=laptop;initial catalog=CAA;integrated security=True;multipleactiveresultsets=True;App=EntityFramework&quot;" providerName="System.Data.EntityClient" /></connectionStrings>
  <system.web>
  <authentication mode="Forms">
      <forms loginUrl="~/login.aspx" timeout="432000" />
    </authentication>
    <membership>
      <providers>
        <clear />
        <add name="AspNetSqlMembershipProvider" type="System.Web.Security.SqlMembershipProvider" connectionStringName="ApplicationServices" enablePasswordRetrieval="false" enablePasswordReset="true" requiresQuestionAndAnswer="false" requiresUniqueEmail="true" maxInvalidPasswordAttempts="5" minRequiredPasswordLength="6" minRequiredNonalphanumericCharacters="0" passwordAttemptWindow="10" applicationName="/" />
      </providers>
    </membership>
    <profile>
      <providers>
        <clear />
        <add name="AspNetSqlProfileProvider" type="System.Web.Profile.SqlProfileProvider" connectionStringName="ApplicationServices" applicationName="/" />
      </providers>
    </profile>
    <roleManager enabled="true" defaultProvider="AspNetSqlRoleProvider" >
      <providers>
        <clear/>
        <add connectionStringName="ApplicationServices"
          applicationName="/"
          name="AspNetSqlRoleProvider"
          type="System.Web.Security.SqlRoleProvider"/>
      </providers>
    </roleManager>
    <httpModules>
      <add name="DomainServiceModule" type="System.ServiceModel.DomainServices.Hosting.DomainServiceHttpModule, System.ServiceModel.DomainServices.Hosting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" />
      
    </httpModules>
    <compilation debug="true" targetFramework="4.0">
      <assemblies>
        <add assembly="System.Design, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B03F5F7F11D50A3A" />
        <add assembly="System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
        <add assembly="System.Speech, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31BF3856AD364E35" />
        <add assembly="System.Data.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />
        <add assembly="System.Web.Entity, Version=4.0.0.0, Culture=neutral, PublicKeyToken=B77A5C561934E089" />
      </assemblies>
    </compilation>
    <httpHandlers>
    </httpHandlers>
    <pages>
      <controls>
        <add tagPrefix="telerik" namespace="Telerik.Web.UI" assembly="Telerik.Web.UI" />
        <add tagPrefix="ajaxToolkit" assembly="AjaxControlToolkit" namespace="AjaxControlToolkit" />
      </controls>
    </pages>
     </system.web>
  <system.webServer>
    <validation validateIntegratedModeConfiguration="false" />
    <handlers>
          </handlers>
    <modules runAllManagedModulesForAllRequests="true">
         </modules>
  </system.webServer>
  <system.serviceModel>
    <serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
  </system.serviceModel>
  <appSettings />
  
</configuration>

I'd be deeply grateful if anyone can spot what's going on... Thank you!!!

Answer 1

User283571144 posted

Hi PaulBinCT2,

Which fails no matter what I try, and as far as I can see the roles are always 0.  Here's my web.config:

I suggest you could use Roles.IsUserInRole instead of RolePrincipal.IsInRole.

As far as I know, User.IsInRole is not a wrapper for the role provider.

It only checks the list of roles that exist in the auth cookie.

I'm guessing at this point in the auth pipeline, the roles haven't yet been assigned to the cookie since it's the first request after doing the auth and the cookie only gets set on the first server response.

Therefore the only valid way to check at this point is to use Roles.IsUserInRole().

Best Regards,

Brando

Answer 2

User-444351719 posted

Hi Brando...

Apologies for the long delay, I was sidetracked on other projects!  Thank you for your reply, but that doesn't work either.  Same problem... the initial login and redirect based on role works fine but when I get to the destination page it fails... same role, same user, etc.  It's very puzzling...

Paul

Answer 3

User283571144 posted

Hi PaulBinCT2,

Apologies for the long delay, I was sidetracked on other projects!  Thank you for your reply, but that doesn't work either.  Same problem... the initial login and redirect based on role works fine but when I get to the destination page it fails... same role, same user, etc.  It's very puzzling...

According to your description, I suggest you could do some troubleshooting by using GetRoles() method to get current user’s roles.

GetRoles:Obtain a list of the roles for the current logged-in user.

Sample Code:

string[] userRoles = ((RolePrincipal)User).GetRoles();

1.I suggest you could add this method in login page to make sure current user has the roles.

2.You could add this method in admin page, and could add a break point to check the user has the value and has correct roles.

Besides, I suggest you could check the browser allows cookies and set cacheRolesInCookie property to true in roleManager.

Because, if the user's browser does not support cookies or if cookies are disabled, role information is instead cached only for the duration of each page request.

More details, you could refer to follow codes:

<roleManager 
    enabled="true" 
    cacheRolesInCookie="true" >
</roleManager>

Best Regards,

Brando