title: MVC windows authentication - user claims deny admin access: target .net4.5
body: <p>Im confused by windows Authentication on a site and how the claims for built in admin are managed.  A user that has Admin rights, but fails the <code>IsInRole(BuiltInAdmin)</code> test.</p>
  
  <ul>
  <li>Why was the deny claim allocated ?</li>
  <li>Should I be checking the user directly and not relying on the claims provided.?</li>
  <li>Is this an outcome on the NON Elevated identity claims using windows auth on the site?</li>
  </ul>
  
  <p>The process was working all as expected until i added an IS admin check for certain cases.
  I have used custom AUTH attribute which is triggered as expected
  <a href="http://msdn.microsoft.com/en-us/library/system.web.mvc.authorizeattribute%28v=vs.108%29.aspx" rel="nofollow noreferrer">Works as expected and documented AuthorizeAttribute</a>
  And I can return true or false. So thats all good.</p>
  
  <p><strong>BUT check for ADMIN role fails.</strong></p>
  
  <p>The CODE:</p>
  
  <pre><code>[AttributeUsage(AttributeTargets.Class)] // all controllers inherit this attribuet
  public class CUSTOMAuth:AuthorizeAttribute {
      protected override bool AuthorizeCore(HttpContextBase httpContext) {
          if (! base.AuthorizeCore(httpContext)) {
              return false;
          }
          // is the identity on teh request an admin ?
          return (IsLocalAdmin(httpContext.Request.LogonUserIdentity));
      }
  }
  
  
      public static bool IsLocalAdmin(WindowsIdentity identity) {
          var localAdmins = new SecurityIdentifier(WellKnownSidType.BuiltinAdministratorsSid, null);
          if (identity != null) {
              var prin = new WindowsPrincipal(identity);
              return (prin.IsInRole(localAdmins));  //&lt;&lt;&lt; returns false
          }
          return false;
      }
  </code></pre>
  
  <p>In debugger i see that httpContext.Request.LogonUserIdentity was delivered with the 
  CLAIMS/denyonlysid: </p>
  
  <p>So that means the request is saying Except built in admin claims.
  Although user Does have admin rights.</p>
  
  <p><strong>EXTRA INFO:</strong>
  The APP POOL uses integrated mode.Windows Authentication,and Has a special user Identity.
  The custom user does NOT have admin rights.</p>
  
  <p><img src="https://i.stack.imgur.com/3TmkT.png" alt="enter image description here"></p>