title: Authorization roles WebAPI oauth owin
body: <p>I implemented a token authorization system on ASP.NET Web API with OWIN middleware. I successfully can authenticate with a REST client and obtain an authorization token to call the API. If I put the <code>[Authorize]</code> attribute on a GET action in my controller it also works correctly. If I don't have a valid token it denies the resource with a 401 message, but if I use <code>[Authorize(Roles="admins")]</code> with the <code>roles</code> parameter, it doesn't recognize the user's roles. I verified things in the database and checked that <code>usersinroles</code> is correctly filled.</p>
  
  <p>This is a code snippet:</p>
  
  <pre><code>[Authorize(Roles = "admins")]
  public IEnumerable&lt;CompanyModel&gt; Get()
  {
      ClaimsPrincipal principal = Request.GetRequestContext().Principal as ClaimsPrincipal;
      bool isrole = principal.IsInRole("admins");
  </code></pre>
  
  <p>I also checked the action without the <code>roles</code> parameter and the <code>isrole</code> boolean is always <code>false</code>. Do I have to enable something?</p>