CODEWITHSUNDEEP
asp.net-2.0roles
J c
J c

Reputation: 6413

Is Roles.IsUserInRole behaving as expected in the following simple scenario?

In a custom role provider (inheriting from RoleProvider) in .NET 2.0, the IsUserInRole method has been hard-coded to always return true:

public override bool IsUserInRole(string username, string roleName) { return true; }

In an ASP.NET application configured to use this role provider, the following code returns true (as expected):

Roles.IsUserInRole("any username", "any rolename"); // results in true

However, the following code returns false:

Roles.IsUserInRole("any rolename"); // results in false

Note that User.IsInRole("any rolename") is also returning false.

  1. Is this the expected behavior?
  2. Is it incorrect to assume that the overload that only takes a role name would still be invoking the overridden IsUserInRole?

Update: Note that there doesn't seem to be an override available for the version that takes a single string, which has led to my assumption in #2.

Upvotes: 3

Views: 3457

Answers (3)

FiveTools
FiveTools

Reputation: 6030

This may help someone - be aware:

If you are using the login control to authenticate - the username entered into the control becomes the HttpContext.Current.User.Identity.Name which is used in the Roles.IsUserInRole(string rolename) and more specifically - the membership's GetUser() method. So if this is the case make sure you override the Authenticate event, validate the user in this method and set the username to a value that your custom membership provider can use. 

 protected void crtlLoginUserLogin_Authenticate(object sender, AuthenticateEventArgs e)
{
    bool blnAuthenticate = false;
    string strUserName = crtlLoginUserLogin.UserName;

    if (IsValidEmail(strUserName))
    {

        //if more than one user has email address - must authenticate by username.

        MembershipUserCollection users = Membership.FindUsersByEmail(strUserName);
        if (users.Count > 1)
        {
            crtlLoginUserLogin.FailureText = "We are unable to determine which account is registered to that email address. Please enter your Username to login.";

        }
        else
        {
            strUserName = Membership.GetUserNameByEmail(strUserName);
            blnAuthenticate = Membership.ValidateUser(strUserName, crtlLoginUserLogin.Password);

            //setting the userLogin to the correct user name (only on successful authentication)
            if (blnAuthenticate)
            {
                crtlLoginUserLogin.UserName = strUserName;
            }

        }


    }
    else
    {
        blnAuthenticate = Membership.ValidateUser(strUserName, crtlLoginUserLogin.Password);
    }

    e.Authenticated = blnAuthenticate;

}

Upvotes: 0

Rebecca
Rebecca

Reputation: 14412

Also beware if you have selected cacheRolesInCookie="true" in the RoleManager config. If you have added a new role to the database, it might be looking at the cached version in the cookie.

I had this problem and the solution was to delete the cookie and re-login.

Upvotes: 0

Andrew Rollings
Andrew Rollings

Reputation: 14571

I looked at Roles.IsUserInRole(string rolename) in .net reflector, and it resolves to the following:

public static bool IsUserInRole(string roleName)
{
    return IsUserInRole(GetCurrentUserName(), roleName);
}

I would take a look at your current user. Here's why:

private static string GetCurrentUserName()
{
    IPrincipal currentUser = GetCurrentUser();
    if ((currentUser != null) && (currentUser.Identity != null))
    {
        return currentUser.Identity.Name;
    }
    return string.Empty;
}

I would be willing to bet this is returning an empty string because you either don't have a Current User, or its name is an empty string or null.

In the IsUserInRole(string username, string roleName) method, there is the following block of code right near the beginning:

   if (username.Length < 1)
   {
       return false;
   }

If your GetCurrentUserName() doesn't return anything meaningful, then it will return false before it calls your overridden method.

Moral to take away from this: Reflector is a great tool :)

Upvotes: 3

Related Questions