title: HttpContext.Current.User != HttpContext.User?
body: <p>Is <strong>HttpContext.Current.User</strong> in global asax not the same as <strong>HttpContext.User</strong> in an action method?  I assigned the user some roles, but they seem to get lost.</p>
  
  <p>The code below shows what is happening.  Both Asserts get hit when a user is logged on, first in global asax, then the action method.  However they give different results.</p>
  
  <p>First this:</p>
  
  <pre><code>protected void Application_AuthenticateRequest(object sender, EventArgs e)
  {
      // ... omitted some code to check user is authenticated
      FormsIdentity identity = (FormsIdentity)HttpContext.Current.User.Identity;
  
      string[] roles = new string[] { "admin", "user" };
  
      HttpContext.Current.User =
          new System.Security.Principal.GenericPrincipal(identity, roles);
  
      Assert(HttpContext.User.IsInRole("admin"));
  }
  </code></pre>
  
  <p>Then this in my action method:</p>
  
  <pre><code>public ActionResult Index()
  {
      bool isAdmin = HttpContext.User.IsInRole("admin");
  
      Assert(isAdmin); // this fails, isAdmin is false
  
      // ...
  }
  </code></pre>
  
  <p>I used the following resources</p>
  
  <p><a href="https://stackoverflow.com/a/1297564/678338">This SO answer</a></p>
  
  <p><a href="http://csharpdotnetfreak.blogspot.com/2009/02/formsauthentication-ticket-roles-aspnet.html" rel="nofollow noreferrer">http://csharpdotnetfreak.blogspot.com/2009/02/formsauthentication-ticket-roles-aspnet.html</a></p>