Identity Role is not getting added to user

Question

I want to use JWT auth for my web api and cookie auth for Razor pages together. I use policy authorization for controllers. Everything works for my Razor pages with this configuration in my Startup.cs:

services.AddIdentity<User, Role>(opt =>{
                opt.Password.RequireDigit = false;
                opt.Password.RequiredLength = 4;
                opt.Password.RequireNonAlphanumeric = false;
                opt.Password.RequireUppercase = false;
                opt.Password.RequireLowercase = false;
            })
            .AddEntityFrameworkStores<DataContext>()
            .AddRoleValidator<RoleValidator<Role>>()
            .AddRoleManager<RoleManager<Role>>()
            .AddSignInManager<SignInManager<User>>();

But my Controller endpoints are not working and when I use the one below it works:

IdentityBuilder builder = services.AddIdentityCore<User>(opt =>
            {
                opt.Password.RequireDigit = false;
                opt.Password.RequiredLength = 4;
                opt.Password.RequireNonAlphanumeric = false;
                opt.Password.RequireUppercase = false;
                opt.Password.RequireLowercase = false;
            });

But the roles are not getting added to the user claims and therefor the authorization policy attributes for my Razor pages always return Access Denied.

public class Startup
    {
        public Startup(IConfiguration configuration)
        {
            Configuration = configuration;
        }

        public IConfiguration Configuration { get; }

        // This method gets called by the runtime. Use this method to add services to the container.
        public void ConfigureServices(IServiceCollection services)
        {

            services.AddDbContext<DataContext>(opt => opt.UseSqlServer(Configuration.GetConnectionString("DefaultConnection")));

            services.ConfigureApplicationCookie(options =>
            {
                // Cookie settings
                options.Cookie.HttpOnly = true;
                options.ExpireTimeSpan = TimeSpan.FromDays(1);
                options.LoginPath = "/Account/Login";
                options.AccessDeniedPath = "/Account/AccessDenied";
                options.SlidingExpiration = true;
                options.Cookie.Name = Configuration.GetSection("AppSettings:AuthCookieName").Value;
            });

            // services.AddIdentity<User, Role>(opt =>{
            //     opt.Password.RequireDigit = false;
            //     opt.Password.RequiredLength = 4;
            //     opt.Password.RequireNonAlphanumeric = false;
            //     opt.Password.RequireUppercase = false;
            //     opt.Password.RequireLowercase = false;
            // });

            IdentityBuilder builder = services.AddIdentityCore<User>(opt =>
            {
                opt.Password.RequireDigit = false;
                opt.Password.RequiredLength = 4;
                opt.Password.RequireNonAlphanumeric = false;
                opt.Password.RequireUppercase = false;
                opt.Password.RequireLowercase = false;
            });

            builder = new IdentityBuilder(builder.UserType, typeof(Role), builder.Services);
            builder.AddEntityFrameworkStores<DataContext>();
            builder.AddRoleValidator<RoleValidator<Role>>();
            builder.AddRoleManager<RoleManager<Role>>();
            builder.AddSignInManager<SignInManager<User>>();

            services.AddAuthorization(options =>{
                 options.AddPolicy("CorrectUserIdRequested", policy=>{
                    policy.AddRequirements(new CorrectUserIdRequestedRequirement());
                });
                options.AddPolicy("RequireAdminRole", policy => policy.RequireRole("admin"));
                options.AddPolicy("RequireUserRole", policy => policy.RequireRole("admin","user"));
            });
            services.AddMvc(options => {
                var policy = new AuthorizationPolicyBuilder()
                    .RequireAuthenticatedUser()
                    .Build();
                options.Filters.Add(new AuthorizeFilter(policy));
            }).
            SetCompatibilityVersion(CompatibilityVersion.Version_2_2)
            .AddJsonOptions(opt =>
                            {
                                opt.SerializerSettings.ReferenceLoopHandling =
                                Newtonsoft.Json.ReferenceLoopHandling.Ignore;
                            });

            // Authentication Scheme
            services.AddAuthentication(IdentityConstants.ApplicationScheme)
                    .AddCookie(IdentityConstants.ApplicationScheme, options =>
                    {

                        //if url start with "/api" use jwt instead
                        options.ForwardDefaultSelector = httpContext => httpContext.Request.Path.StartsWithSegments("/api") ? JwtBearerDefaults.AuthenticationScheme : null;
                    })
                    .AddJwtBearer(o =>
                    {
                        o.TokenValidationParameters = new TokenValidationParameters
                        {
                            ValidateIssuerSigningKey = true,
                            IssuerSigningKey = new SymmetricSecurityKey(Encoding.ASCII
                            .GetBytes(Configuration.GetSection("AppSettings:Token").Value)),
                            ValidateIssuer = false,
                            ValidateAudience = false
                        };
                    });
            Mapper.Reset();
            services.AddCors();
            services.AddAutoMapper(typeof(Startup));
            //Injections
            services.AddTransient<Seed>();
            services.AddScoped<AuthService, AuthServicePasswordless>();
            services.AddScoped<IUserRepository, UserRepository>();
            services.AddScoped<INotificationService, SmsNotifyService>();
        }

        // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
        public void Configure(IApplicationBuilder app, IHostingEnvironment env, Seed seeder)
        {
            if (env.IsDevelopment())
            {
                app.UseDeveloperExceptionPage();
            }
            else
            {
                app.UseExceptionHandler(builder => {
                    builder.Run(async context => {
                        context.Response.StatusCode = (int)HttpStatusCode.InternalServerError;

                        var error = context.Features.Get<IExceptionHandlerFeature>();
                        if(error != null){
                            context.Response.AddApplicationError(error.Error.Message);
                            await context.Response.WriteAsync(error.Error.Message);
                        }
                    });
                });                // The default HSTS value is 30 days. You may want to change this for production scenarios, see https://aka.ms/aspnetcore-hsts.
                // app.UseHsts();
            }

            // app.UseHttpsRedirection();
            app.UseStaticFiles();
            app.UseCookiePolicy();
            seeder.SeedUsers();
            app.UseAuthentication();
            app.UseMvc(routes =>
            {                
                routes.MapRoute(
                    name: null,
                    template: "{area:exists}/{controller=Dashboard}/{action=Index}/{id?}");

                routes.MapRoute(
                    name: "default",
                    template: "{controller=Home}/{action=Index}/{id?}");
            });
        }
    }


//Controller
[Authorize(Policy = "RequireAdminRole")]
    [Area("Admin")]
    public class DashboardController : Controller
    {
        public IActionResult Index(){
            return View();
        }
    }

Answer 1

Note you created a brand new IdentityBuilder and then configured the new createdIdentityBuilder instead of the one returned by services.AddIdentityCore<>():

IdentityBuilder builder = services.AddIdentityCore<User>(opt =>
{
    opt.Password.RequireDigit = false;
    opt.Password.RequiredLength = 4;
    opt.Password.RequireNonAlphanumeric = false;
    opt.Password.RequireUppercase = false;
    opt.Password.RequireLowercase = false;
});

builder = new IdentityBuilder(builder.UserType, typeof(Role), builder.Services);

... configure the builder

How to fix :

To fix the problem, you need configure the same builder registered in service container:

builder = new IdentityBuilder(builder.UserType, typeof(IdentityRole), builder.Services);

---

Finally, don't forget to logout firstly and sign in again to make the user get the roles.

---

As a side note, you don't need to add write so many codes to configure the Identity Authentication. A better way is to invoke AddDefaultIdentity<User>() instead of AddIdentityCore() to simplify your code :

IdentityBuilder builder = services.AddDefaultIdentity<User>(opt =>
{
    ...
})
    .AddRoles<Role>()
    .AddDefaultTokenProviders()
    .AddEntityFrameworkStores<DataContext>()
    ;

builder = new IdentityBuilder(builder.UserType, typeof(Role), builder.Services);
builder.AddEntityFrameworkStores<DataContext>();
builder.AddRoleValidator<RoleValidator<Role>>();
builder.AddRoleManager<RoleManager<Role>>();
builder.AddSignInManager<SignInManager<User>>();

....

services.Configure<CookieAuthenticationOptions>(IdentityConstants.ApplicationScheme,opt=>{
    //if url start with "/api" use jwt instead
    opt.ForwardDefaultSelector = httpContext => httpContext.Request.Path.StartsWithSegments("/api") ? JwtBearerDefaults.AuthenticationScheme : null;
});


services.AddAuthentication(IdentityConstants.ApplicationScheme)
    .AddCookie(IdentityConstants.ApplicationScheme, options =>
        {
            //if url start with "/api" use jwt instead
            options.ForwardDefaultSelector = httpContext => httpContext.Request.Path.StartsWithSegments("/api") ? JwtBearerDefaults.AuthenticationScheme : null;
        }) 
        .AddJwtBearer(o =>
        {
            ...
        });

---

Demo :