ASP.NET Core 2.0 unable to check if user is in role properly in Razor view or controller [authorize] annotation

Question

I'm working on a legacy project with roles based authorization but I'm having some issues. User.IsInRole("admin") and [Authorize(Roles = "admin")] always failing Authorization. the User.IsInRole() always returns False. I'm pretty sure that user was properly added to the role. Role name 'admin' is already taken. User already in role 'admin'.

Maybe some service are influencing another.

Here is my startup.cs resumed code:

public void ConfigureServices(IServiceCollection services){

    services.AddDbContext<ApplicationDbContext>(options => options.UseMySql(connetctionString));

    services.AddIdentity<ApplicationUser, IdentityRole>()
        .AddEntityFrameworkStores<ApplicationDbContext>()
        .AddDefaultTokenProviders();

    services.AddScoped<IUserClaimsPrincipalFactory<ApplicationUser>, CustomUserClaimsPrincipalFactory>();
    services.AddMvc();
    services.AddDistributedMemoryCache();
    services.AddSession();
}

public void Configure(IApplicationBuilder app, IHostingEnvironment env){
    app.UseStaticFiles();
    app.UseAuthentication();
    app.UseMvc(routes => {...});
}

What am I missing?

PS. Yes, I logged ou and login.

PS. Yes the user is in the role admin

PS. the "admin" are correct in lowercase

PS. ApplicationDbContext inherits IdentityDbContext

Ps2. Here is my Data

SELECT id,username FROM aspnetusers;

|id          | username        |
|c4f7bf16... | [email protected] |

SELECT Id,Name FROM aspnetroles;

|Id          | Name  |
|50e2a572... | admin |

SELECT * FROM aspnetuserroles;

|UserId      | RoleId     |
|c4f7bf16... | 50e2a572...|

Answer 1

I have a feeling that this is because your Roles and your Claims are mixed up somewhere.

According to the docs the ClaimsPrincipal.IsInRole() method checks for Claims of type ClaimsIdentity.RoleClaimType.

It is possible to set a Claim of "admin" without it being of ClaimType ClaimsIdentity.RoleClaimType in which case it will fail authentication.