title: Context.User losing Roles after being assigned in Global.asax.Application_AuthenticateRequest
body: <p>I am using Forms authentication in my asp.net (3.5) application. I am also using roles to define what user can access which subdirectories of the app. Thus, the pertinent sections of my web.config file look like this:</p>
  
  <pre><code>&lt;system.web&gt;
    &lt;authentication mode="Forms"&gt;
      &lt;forms loginUrl="Default.aspx" path="/" protection="All" timeout="360" name="MyAppName" cookieless="UseCookies"  /&gt;      
    &lt;/authentication&gt;
    &lt;authorization &gt;
      &lt;allow users="*"/&gt;
    &lt;/authorization&gt;
  &lt;/system.web&gt;
  
  &lt;location path="Admin"&gt;
    &lt;system.web&gt;
      &lt;authorization&gt;
        &lt;allow roles="Admin"/&gt;
        &lt;deny users="*"/&gt;
      &lt;/authorization&gt;
    &lt;/system.web&gt;
  &lt;/location&gt;
  </code></pre>
  
  <p>Based on what I have read, this should ensure that the only users able to access the Admin directory will be users who have been Authenticated and assigned the Admin role.</p>
  
  <p>User authentication, saving the authentication ticket, and other related issues all work fine. If I remove the  tags from the web.config file, everything works fine. The problem comes when I try to enforce that only users with the Admin role should be able to access the Admin directory.</p>
  
  <p>Based on this <a href="http://support.microsoft.com/kb/311495" rel="nofollow noreferrer">MS KB article</a> along with other webpages giving the same information, I have added the following code to my Global.asax file:</p>
  
  <pre><code>protected void Application_AuthenticateRequest(Object sender, EventArgs e) {
      if (HttpContext.Current.User != null) {
          if (Request.IsAuthenticated == true) {    
              // Debug#1            
              FormsAuthenticationTicket ticket = FormsAuthentication.Decrypt(Context.Request.Cookies[FormsAuthentication.FormsCookieName].Value);
              // In this case, ticket.UserData = "Admin"                
              string[] roles = new string[1] { ticket.UserData }; 
              FormsIdentity id = new FormsIdentity(ticket);
              Context.User = new System.Security.Principal.GenericPrincipal(id, roles);
              // Debug#2
          }
      }
  }
  </code></pre>
  
  <p>However, when I try to log in, I am unable to access the Admin folder (get redirected to login page). </p>
  
  <p>Trying to debug the issue, if I step through a request, if I execute Context.User.IsInRole("Admin") at the line marked Debug#1 above, it returns a false. If I execute the same statement at line Debug#2, it equals true. So at least as far as Global.asax is concerned, the Role is being assigned properly.</p>
  
  <p>After Global.asax, execution jumps right to the Login page (since the lack of role causes the page load in the admin folder to be rejected). However, when I execute the same statement on the first line of Page_Load of the login, it returns false. So somewhere after Application_AuthenticateRequest in Global.asax and the initial load of the WebForm in the restricted directory, the role information is being lost, causing authentication to fail (note: in Page_Load, the proper Authentication ticket is still assigned to Context.User.Id - only the role is being lost).</p>
  
  <p>What am I doing wrong, and how can I get it to work properly?</p>
  
  <hr>
  
  <p><strong>Update: I entered the <a href="https://stackoverflow.com/questions/56271/contextuser-losing-roles-after-being-assigned-in-globalasaxapplicationauthentic#57040">solution below</a></strong></p>