title: Role Based Authentication for web API not working
body: <p>I'm facing an issue while working with Role-Based authentication for web APi.</p>
  <p>I have a controller class where the controller has a custom authorize attribute called Myauthorize.
  I have a method inside the controller which can be accessed only with Admin access.
  But the same method has been calling with QA access as well.
  Could anyone please help with the below?</p>
  <p>Please find the code below.
  Controller :</p>
  <pre><code>namespace Hosiptal.Controllers.office
  {
   [MyAuthorize(Constants.Roles.Admin)]
   public class UserRolesController : ApiController
   {
      private readonly IRepository&lt;EntityModels.Role&gt; rolesRepository;
  
      public UserRolesController(IRepository&lt;EntityModels.Role&gt; rolesRepository)
      {            
          this.rolesRepository = rolesRepository;
      }
  
      // GET: Users
      [HttpGet]
      [Route(&quot;&quot;)]        
      public IEnumerable&lt;Role&gt; GetAll()
      {
          return this.rolesRepository.GetAll()
              .ToArray()
              .Select(r =&gt; Mapper.Current.Get&lt;Role&gt;(r));                
      }
    }
  }
  </code></pre>
  <p>MyAuthorize has followed.</p>
  <pre><code>namespace Hospital.Web.Filters.WebApi
  {
  
   public class MyAuthorize: AuthorizeAttribute
   {
      private readonly string[] allowedroles;
      private static IUserProfileRepository UserProfileRepository
      {
          get { return IoC.Current.Resolve&lt;IUserProfileRepository&gt;(); }
      }
      public MyAuthorize(params string[] roles)
      {
          this.allowedroles = roles;
      }
  
      public override Task OnAuthorizationAsync(HttpActionContext actionContext, CancellationToken 
        cancellationToken)
      {
          var claimsIdentity = actionContext.RequestContext.Principal.Identity as ClaimsIdentity;
          
          var alias = claimsIdentity.Name.Split('@')[0];
          if (alias == null)
          {
              throw new ArgumentNullException(nameof(actionContext));
          }
          user(alias);
          return base.OnAuthorizationAsync(actionContext, cancellationToken);
      }
  
      public static GenericPrincipal user(string userName)
      {
          userName = userName.ToUpper();
  
          var userProfile = UserProfileRepository.Get(userName) ?? new UserProfile()
          {
              UserName = userName,
              Roles = new List&lt;Role&gt;(),
              FirstLoginDateUtc = DateTime.UtcNow
          };
          return CreatePrincipal(userProfile);
      }
      public static GenericPrincipal CreatePrincipal(UserProfile user)
      {
          var identity = new ClaimsIdentity(new[] { new Claim(ClaimTypes.Name, 
                             user.UserName) }, &quot;Custom&quot;);
          return new GenericPrincipal(identity, user.Roles.Select(i =&gt; 
                i.Name).ToArray());
      }
     }
   }
  </code></pre>
  <p>How can restrict the user here based on access level?</p>