title: IsInRole() Method is not working?
body: <p>I create authentication login based on this article: <br/>
  <a href="http://www.codeproject.com/Articles/2905/Role-based-Security-with-Forms-Authentication" rel="nofollow">http://www.codeproject.com/Articles/2905/Role-based-Security-with-Forms-Authentication</a><br/>
  All works fine, I can log in based on user, but I am having problem with IsInRole method. If I log in in any role the Adminlink still appear to all users. I just did almost all the same as the above article. </p>
  
  <p>The code of Global.asax</p>
  
  <pre><code>protected void Application_AuthenticateRequest(object sender, EventArgs e)
      {
          if (HttpContext.Current.User != null)
          {
              if (HttpContext.Current.User.Identity.IsAuthenticated)
              {
                  if (HttpContext.Current.User.Identity is FormsIdentity)
                  {
                      FormsIdentity id =
                          (FormsIdentity)HttpContext.Current.User.Identity;
                      FormsAuthenticationTicket ticket = id.Ticket;
  
                      // Get the stored user-data, in this case, our roles
                      string userData = ticket.UserData;
                      string[] roles = userData.Split(',');
                      HttpContext.Current.User = new GenericPrincipal(id, roles);
                  }
              }
          }
      }
  </code></pre>
  
  <p>The code of Web.config</p>
  
  <pre><code>&lt;configuration&gt;
    &lt;connectionStrings&gt;
      &lt;add name="databasestring" connectionString="Data Source=USER-PC;Initial Catalog=database;Integrated Security=True"
        providerName="System.Data.SqlClient" /&gt;
    &lt;/connectionStrings&gt;
    &lt;system.web&gt;
      &lt;authentication mode="Forms"&gt;
       &lt;forms name="MYWEBAPP.ASPXAUTH"
           loginUrl="login.aspx"
           protection="All"
             path="/"/&gt;
       &lt;/authentication&gt;
      &lt;authorization&gt;
        &lt;allow users="*"/&gt;
         &lt;/authorization&gt;
    &lt;/system.web&gt;
    &lt;location path="admin"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;!-- Order and case are important below --&gt;
          &lt;allow roles="Admin"/&gt;
          &lt;deny users="*"/&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
    &lt;location path="librarian"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;!-- Order and case are important below --&gt;
          &lt;allow roles="Librarian"/&gt;
            &lt;deny users="*"/&gt;
        &lt;/authorization&gt;
      &lt;/system.web&gt;
    &lt;/location&gt;
  &lt;/configuration&gt;
  </code></pre>
  
  <p>The code of login button: </p>
  
  <pre><code>protected void btnLogin_Click(object sender, EventArgs e)
      {
              // Initialize FormsAuthentication, for what it's worth
              FormsAuthentication.Initialize();
  
              // Create our connection and command objects
              SqlConnection conn =
               new SqlConnection("Data Source=USER-PC;Initial Catalog=database;Integrated Security=True");
              SqlCommand cmd = conn.CreateCommand();
              cmd.CommandText = "SELECT UserType FROM users WHERE UserID=@UserID AND UserPassword=@UserPassword";
  
              // Fill our parameters
              cmd.Parameters.Add("@UserID", SqlDbType.NVarChar, 64).Value = UserID.Value;
              cmd.Parameters.Add("@UserPassword", SqlDbType.NVarChar, 128).Value = UserPassword.Value; // Or "sha1"
  
              // Execute the command
              conn.Open();
              SqlDataReader reader = cmd.ExecuteReader();
              if (reader.Read())
              {
                  // Create a new ticket used for authentication
                  FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(
                     1, // Ticket version
                     UserID.Value, // Username associated with ticket
                     DateTime.Now, // Date/time issued
                     DateTime.Now.AddMinutes(30), // Date/time to expire
                     true, // "true" for a persistent user cookie
                     reader.GetString(0), // User-data, in this case the roles
                     FormsAuthentication.FormsCookiePath);// Path cookie valid for
  
                  // Encrypt the cookie using the machine key for secure transport
                  string hash = FormsAuthentication.Encrypt(ticket);
                  HttpCookie cookie = new HttpCookie(
                     FormsAuthentication.FormsCookieName, // Name of auth cookie
                     hash); // Hashed ticket
  
                  // Set the cookie's expiration time to the tickets expiration time
                  if (ticket.IsPersistent) cookie.Expires = ticket.Expiration;
  
                  // Add the cookie to the list for outgoing response
                  Response.Cookies.Add(cookie);
  
                  // Redirect to requested URL, or homepage if no previous page
                  // requested
                  string returnUrl = Request.QueryString["/WebForm2.aspx"];
                  if (returnUrl == null) returnUrl = "/WebForm2.aspx";
  
                  // Don't call FormsAuthentication.RedirectFromLoginPage since it
                  // could
                  // replace the authentication ticket (cookie) we just added
                  Response.Redirect(returnUrl);
              }
              else
              {
                  // Never tell the user if just the username is password is incorrect.
                  // That just gives them a place to start, once they've found one or
                  // the other is correct!
                  ErrorLabel.Text = "Username / password incorrect. Please try again.";
                  ErrorLabel.Visible = true;
              }
  
              reader.Close();
              conn.Close();
          }
   }
  </code></pre>
  
  <p>The code of WebForm2.aspx</p>
  
  <pre><code>protected void Page_Load(object sender, EventArgs e)
      {
          if (User.IsInRole("Admin"))
          {
              AdminLink.Visible = true;
          }
      }
  </code></pre>