title: Role based authorization in ASP.NET Core 3.1 with Identity and ExternalLogin
body: <p>Im new to .NET Core and I'm trying to setup Role based authorization in a .NET Core 3.1 project. I believe I clicked on every tutorials and threads talking about it online. My problem is that it seems to be working very easily on the tutorials, but it doesn't work for me. According to tutorials I have found, all I would have to do is assign a role to a user in a database, then use <code>[Authorize(Roles="roleName")]</code> before a Controller's Action. When I do that I always get a 403 error for a user having the specified role. When I use <code>userManager.GetRolesAsync(user)</code>, I see that the user has the role. When I make a request to this action with [Authorize], it works when the user is logged in, as expected.</p>
  
  <p>I checked in debug mode ClaimsPrincipal.Identity for the current user and I found out that <code>RoleClaimType = "role"</code>. I checked the claims of the current user and found out that it doesn't have a claim with a type "role". Is this how <code>[Authorize(Roles="...")]</code> works? Does it look a the claims? If so, how do I had a claim for the user's role? The only way for a user to login in this application is with a Google account. So how am I supposed to add a claim if they are managed by the Google login?</p>
  
  <p>Here's my code in Startup.cs</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddDbContext&lt;ApplicationDbContext&gt;(options =&gt;
          options.UseNpgsql(Configuration.GetConnectionString("DefaultConnection")));
  
      services.AddDefaultIdentity&lt;ApplicationUser&gt;()
          .AddRoles&lt;ApplicationRole&gt;()
          .AddEntityFrameworkStores&lt;ApplicationDbContext&gt;();
  
      services.AddIdentityServer()
          .AddApiAuthorization&lt;ApplicationUser, ApplicationDbContext&gt;();
  
      services.AddAuthentication()
          .AddGoogle(options =&gt;
          {
              IConfigurationSection googleAuthNSection =
              Configuration.GetSection("Authentication:Google");
  
              options.ClientId = googleAuthNSection["ClientId"];
              options.ClientSecret = googleAuthNSection["ClientSecret"];
          })
          .AddIdentityServerJwt();
  
      services.AddControllersWithViews();
      services.AddRazorPages();
      services.AddSpaStaticFiles(configuration =&gt;
      {
          configuration.RootPath = "ClientApp/dist";
      });
  }
  
  public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
  {
      if (env.IsDevelopment())
      {
          app.UseDeveloperExceptionPage();
          app.UseDatabaseErrorPage();
      }
      else
      {
          app.UseExceptionHandler("/Error");
          app.UseHsts();
      }
  
      app.UseHttpsRedirection();
      app.UseStaticFiles();
      if (!env.IsDevelopment())
      {
          app.UseSpaStaticFiles();
      }
      app.UseRouting();
      app.UseIdentityServer();
      app.UseAuthorization();
      app.UseEndpoints(endpoints =&gt;
      {
          endpoints.MapControllerRoute(
              name: "default",
              pattern: "{controller}/{action=Index}/{id?}");
          endpoints.MapRazorPages();
      });
  
      app.UseSpa(spa =&gt;
      {
          spa.Options.SourcePath = "ClientApp";
  
              if (env.IsDevelopment())
              {
                  spa.UseAngularCliServer(npmScript: "start");
              }
      });
  }
  </code></pre>
  
  <p>Here's an exemple of an Action of a Controller</p>
  
  <pre><code>[Authorize(Roles = "Admin")]
  [HttpGet("userinformations")]
  public async Task&lt;UserInformations&gt; GetCurrentUserInformations()
  {
      string strUserId = this.User.FindFirstValue(ClaimTypes.NameIdentifier);
  
      ApplicationUser user = await userManager.FindByIdAsync(strUserId);
  
      string[] roles = (await userManager.GetRolesAsync(user)).ToArray();
  
      UserInformations userInfo = new UserInformations()
      {
          UserName = user.UserName,
          FirstName = user.FirstName,
          LastName = user.LastName,
          Email = user.Email,
          Organization = user.idDefaultOrganisation.HasValue ? user.DefaultOrganization.OrganizationName : "",
          Claims = this.User.Claims.Select(c =&gt; $"{c.Type} : {c.Value}").ToArray(),
          Roles = roles
      };
  
      return userInfo;
  }
  </code></pre>
  
  <p>When I make a request to this Action without [Authorize(Roles = "Admin")], I can see that the current user has the role Admin, but when I add it, I get a 403 error.</p>
  
  <p>What am I doing wrong? I feel like I'm missing one line somewhere or something like that because it all seems so simple in the tutorials I found.</p>