c# - Role-based restriction not working for ASP.NET MVC Forms Authentication via AD -

i've got asp.net mvc page i'd secure login , not authenticate against active directory using forms authentication, grant access specific roles.

web.config

<system.web>     <authentication mode="forms">         <forms name=".adauthcookie" loginurl="~/home/login" timeout=45 protection="all" />     </authentication>     <authorization>         <allow roles="admin" />         <deny users="*" />     </authorization>     ... 

controllers

[httpget] public actionresult index() {     return view("~/ng-app/index_template.cshtml"); }  [httpget, allowanonymous] public actionresult login() {     return view("~/ng-app/login_template.cshtml"); }  [httppost, allowanonymous] public actionresult login(logindto dto) {     ... // validate dto & stuff     formsauthentication.setauthcookie(loginmodel.username, loginmodel.rememberme); } 

now, basic protection , general authentication works perfectly. can log in domain account , don't have access other pages anonymous users. however, i'm somehow unable restrict access role. when add <allow roles="admin" /> authorization section, absolutely nothing. when additionally add <deny users="*" />, lock myself out , after successful login, server returns 302 found without doing redirects or serving actual file.

you should doing allowed roles on controller declaration

so above actionresult declaration put above

[httpget] [authorize(roles="admin")] public actionresult authorizedview() {     return view("~/ng-app/admin_template.cshtml"); } 

this check see if user in role declared or not

to declare roles in webconfig below

<authorizationconfiguration>   <controllerauthorizationmappings>     <add controller="home" role="generalaccess">               <!-- define allowed roles actions under home controller -->       <actionauthorizationmappings>         <add action="mytopsecretactionforsupercoolpeopleonly" roles="developer,manager,fonzie" />       </actionauthorizationmappings>     </add>   </controllerauthorizationmappings> </authorizationconfiguration> 

and here link site

http://www.ryanmwright.com/2010/04/25/dynamic-controlleraction-authorization-in-asp-net-mvc/

there far me bring thread, turn in wiki answer when have 5 minutes