title: How to use new ASP.NET Identity 2.0 Roles and Authorize Attribute?
body: <p>I am using the new ASP.NET Identity 2.0 system. I know I can check if a user is in a role like this:</p>
  
  <pre><code>bool isAdmin = UserManager.IsInRole(User.Identity.GetUserId(), 
     "Customer Account Admin");
  </code></pre>
  
  <p>I guess this code can be written to check before certain code is run but what about the [Authorize] attribute. I used to be able say:</p>
  
  <pre><code>[Authorize(Role="Customer Account Admin")]
  </code></pre>
  
  <p>This doesn't work anymore because I am not using the old membership or Role Management anymore. How can I put the two together? Or how do I guard against certain parts of the application not being available to members of the right role?</p>
  
  <p>Edit1: I don't believe that it's working. I put the following Authorize attribute on an Admin page and I am able to execute the code as a "Customer Account User"</p>
  
  <pre><code>   [Authorize(Roles = "Customer Service Admin, Savitas Admin")]
      public partial class _default : System.Web.UI.Page
  </code></pre>
  
  <p>Also, I would like to block that page from being seen by unauthorized users. We have code to block the menu but I can still type the URL to the Admin page and it can be seen by unauthorized users</p>
  
  <pre><code> if (HttpContext.Current.User.IsInRole("Customer Account Admin"))
                      //
                      {
                      }
                      else
                      {
                          mi = radmenu1.Items.FindItemByText("Admin");
                          radmenu1.Items.Remove(mi);
                      }
  </code></pre>
  
  <p>EDIT2: We created the roles manually in the ASpNetRoles table and mapped users to roles in the ASPNetUsersToRoles table. There is a mapping from users to roles like "Customer Service Admin." We add users to roles with the following but I don't believe it works:</p>
  
  <pre><code>if (manager.AddToRole(manager.FindByName(UserName.Text).Id, "Customer Account Admin").Succeeded)
                                  {
                                      c.logActivity("Register.aspx.cs", "REG_USER_ROLE", "Setting user to Admin role succeeded");
                                  }
  </code></pre>
  
  <p>When a regular user logs in they don't get an Admin menu to the Admin page by typing into the address bar: </p>
  
  <pre><code>http://localhost:53620/Admin/default
  </code></pre>
  
  <p>How do I stop that?</p>
  
  <p>Edit3: I tried to block all users to the Admin page per your example Eric but once again, I can log in as a Customer User and still type the above in the address bar and get to the page. What's wrong with this:</p>
  
  <pre><code>    &lt;configuration&gt;
    &lt;configSections&gt;
  
      &lt;section name="entityFramework" type="System.Data.Entity.Internal.ConfigFile.EntityFrameworkSection, EntityFramework, Version=6.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" requirePermission="false" /&gt;
    &lt;!-- For more information on Entity Framework configuration, visit http://go.microsoft.com/fwlink/?LinkID=237468 --&gt;&lt;/configSections&gt;
    &lt;connectionStrings&gt;
      ...
    &lt;/connectionStrings&gt;
    &lt;location path="~/Admin/default.aspx"&gt;
      &lt;system.web&gt;
        &lt;authorization&gt;
          &lt;allow roles="Customer Service Admin" /&gt;
          &lt;deny users="*"/&gt;
        &lt;/authorization&gt;
  </code></pre>
  
  <p>Edit4: Switching to path="Admin/default.aspx" gives the following config file error:</p>
  
  <pre><code>Configuration Error 
    Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately. 
  
   Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level.  This error can be caused by a virtual directory not being configured as an application in IIS.
  
  Source Error: 
  
  
  
  Line 66:         &lt;/controls&gt;
  Line 67:       &lt;/pages&gt;
  Line 68:       &lt;membership&gt;
  Line 69:         &lt;providers&gt;
  Line 70:           &lt;!--        ASP.NET Membership is disabled in this template. Please visit the following link http://go.microsoft.com/fwlink/?LinkId=301889 to learn about the ASP.NET Membership support in this template
  </code></pre>