asp.net web api - webapi-use claims with windows authentication -

the method has been secured roles=admin:

[authorize(roles = "admin")] public class valuescontroller : apicontroller {      // api/values             public ienumerable<string> get()     {         return new string[] { "value1", "value2" };     }} 

i use claims webapi project individual user account selected claim admin injected in

public class applicationuser : identityuser {     public async task<claimsidentity> generateuseridentityasync(usermanager<applicationuser> manager, string authenticationtype)     {         // note authenticationtype must match 1 defined in cookieauthenticationoptions.authenticationtype         var useridentity = await manager.createidentityasync(this, authenticationtype);          // add custom user claims here         useridentity.addclaim(new claim(claimtypes.role, "admin"));          return useridentity;     } } 

now want test windows authentication option iauthenticationfilter implemented:

public class customauthenticationfilter : iauthenticationfilter {     public bool allowmultiple { { return true; } }     public task authenticateasync(httpauthenticationcontext context, cancellationtoken cancellationtoken)     {         var windowsprincipal = context.principal windowsprincipal;         if (windowsprincipal != null)         {             var name = windowsprincipal.identity.name;             // todo: fetch claims db (i guess based on name)             var identity = new claimsidentity(windowsprincipal.identity);              identity.addclaim(new claim(claimtypes.role, "admin"));              var claimsprincipal = new claimsprincipal(identity);             // here punchline - we're replacing original windows principal              // our own claims principal               context.principal = claimsprincipal;         }          return task.fromresult(0);     }      public task challengeasync(httpauthenticationchallengecontext context, cancellationtoken cancellationtoken)     {         return task.fromresult(0);     } } 

and added class webapiconfig:

public static class webapiconfig {     public static void register(httpconfiguration config)     {         // web api configuration , services         config.filters.add(new customauthenticationfilter());          ...     } } 

the claim admin in user.identity.claims when debugging webapi project, not authorized in method /api/values/get.

any idea?

the default identity roleclaimtype identity/claims/groupsid not role.

by setting roleclaimtype identity/claims/role in claimsidentity constructor, can passing [authorize(roles = "admin")]

public task authenticateasync(httpauthenticationcontext context, cancellationtoken cancellationtoken)     {         var windowsprincipal = context.principal windowsprincipal;         if (windowsprincipal != null)         {             var name = windowsprincipal.identity.name;              // todo: fetch claims db (i guess based on name)                             var identity = new claimsidentity(windowsprincipal.identity,                 null,                 "negotiate",                 "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name",                 "http://schemas.microsoft.com/ws/2008/06/identity/claims/role");             //identity              identity.addclaim(new claim(claimtypes.role, "admin"));              var claimsprincipal = new claimsprincipal(identity);             // here punchline - we're replacing original windows principal              // our own claims principal               context.principal = claimsprincipal;         }          return task.fromresult(0);     } 

here new identity: