Question

In a custom role provider (inheriting from RoleProvider) in .NET 2.0, the IsUserInRole method has been hard-coded to always return true:

public override bool IsUserInRole(string username, string roleName) { return true; } 

In an ASP.NET application configured to use this role provider, the following code returns true (as expected):

Roles.IsUserInRole('any username', 'any rolename'); // results in true 

However, the following code returns false:

Roles.IsUserInRole('any rolename'); // results in false 

Note that User.IsInRole(‘any rolename’) is also returning false.

1. Is this the expected behavior?
2. Is it incorrect to assume that the overload that only takes a role name would still be invoking the overridden IsUserInRole?

Update: Note that there doesn’t seem to be an override available for the version that takes a single string, which has led to my assumption in #2.

Answer 1

I looked at Roles.IsUserInRole(string rolename) in .net reflector, and it resolves to the following:

public static bool IsUserInRole(string roleName) {     return IsUserInRole(GetCurrentUserName(), roleName); } 

I would take a look at your current user. Here’s why:

private static string GetCurrentUserName() {     IPrincipal currentUser = GetCurrentUser();     if ((currentUser != null) && (currentUser.Identity != null))     {         return currentUser.Identity.Name;     }     return string.Empty; } 

I would be willing to bet this is returning an empty string because you either don’t have a Current User, or its name is an empty string or null.

In the IsUserInRole(string username, string roleName) method, there is the following block of code right near the beginning:

   if (username.Length < 1)    {        return false;    } 

If your GetCurrentUserName() doesn’t return anything meaningful, then it will return false before it calls your overridden method.

Moral to take away from this: Reflector is a great tool 🙂