# Blazor SecurityService.IsInRole() issue

**URL:** <https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213>\
**Category:** Blazor Server\
**Created:** [April 9, 2020, 3:27pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213 "2020-04-09T15:27:42Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![baj](https://forum.radzen.com/letter_avatar_proxy/v4/letter/b/90db22/32.png) [@baj](https://forum.radzen.com/u/baj)\
**Post date:** [April 9, 2020, 3:27pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/1 "2020-04-09T15:27:42Z")

</div>

Hello,

I am attempting to create a Blazor Server application that will secure pages based on two separate security roles, Admins and Users. All accounts will be assigned to one of these roles, but never both. Some pages will be accessible to only Admins, while others will be accessible to both roles.

I have noticed that when I assign both roles to a page's Access property, the page does not show up in the PanelMenu after login. The page can be accessed if you manually enter the page URL in the browser.

The @attribute [Authorize(Roles="")] directive appears to allow the page to be accessed if the logged in account is a member of one on the assigned roles while your SecurityService.IsInRole() implementation appears to require that the logged in account is a member of all of the assigned roles.

Thanks,  
baj

---

<div class="post-metadata">

**Author:** ![korchev](https://forum.radzen.com/user_avatar/forum.radzen.com/korchev/32/4_2.png) [@korchev](https://forum.radzen.com/u/korchev)\
**Post date:** [April 9, 2020, 4:58pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/2 "2020-04-09T16:58:38Z")

</div>

Hi @baj,

Indeed you are right. We will address that in the next Radzen release.

---

<div class="post-metadata">

**Author:** ![jamesmd2](https://forum.radzen.com/letter_avatar_proxy/v4/letter/j/8797f3/32.png) [@jamesmd2](https://forum.radzen.com/u/jamesmd2)\
**Post date:** [July 29, 2020, 4:35pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/3 "2020-07-29T16:35:47Z")

</div>

Hi, I've just recently updated to 2.51.2 and the IsInRole method is still not functioning correctly when multiple roles are assigned to a page. Using AD security.

if (!Principal.IsInRole(role))  
{  
return false;  
}

thanks

---

<div class="post-metadata">

**Author:** ![korchev](https://forum.radzen.com/user_avatar/forum.radzen.com/korchev/32/4_2.png) [@korchev](https://forum.radzen.com/u/korchev)\
**Post date:** [July 29, 2020, 4:45pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/4 "2020-07-29T16:45:22Z")

</div>

The IsInRole method looks like this:

```auto
        public bool IsInRole(params string[] roles)
        {
            if (!IsAuthenticated())
            {
                return false;
            }

            if (roles.Contains("Authenticated"))
            {
                return true;
            }

            return roles.Any(role => Principal.IsInRole(role));
        }

```

Should work as expected - returns true if the principal is member of any of the provided roles.

---

<div class="post-metadata">

**Author:** ![jamesmd2](https://forum.radzen.com/letter_avatar_proxy/v4/letter/j/8797f3/32.png) [@jamesmd2](https://forum.radzen.com/u/jamesmd2)\
**Post date:** [July 29, 2020, 5:18pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/5 "2020-07-29T17:18:47Z")

</div>

Agreed, I see that that is the code for Default security. When using AD security it generates what I listed.

---

<div class="post-metadata">

**Author:** ![korchev](https://forum.radzen.com/user_avatar/forum.radzen.com/korchev/32/4_2.png) [@korchev](https://forum.radzen.com/u/korchev)\
**Post date:** [July 29, 2020, 6:38pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/6 "2020-07-29T18:38:24Z")

</div>

This is the code for Active Directory security as well. Make sure your SecurityService isn't in the code generation ignore list.

---

<div class="post-metadata">

**Author:** ![jamesmd2](https://forum.radzen.com/letter_avatar_proxy/v4/letter/j/8797f3/32.png) [@jamesmd2](https://forum.radzen.com/u/jamesmd2)\
**Post date:** [July 29, 2020, 8:24pm UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/7 "2020-07-29T20:24:31Z")

</div>

I created 2 new simple Blazor projects, 1 using Default security, and the other using AD security. The Default has your code(+), but the AD still shows the original code I posted. No ignore list in use. I've also updated to 2.51.3.

What could cause my install to generate differently than expected?

**Default Security**

 ![image](https://forum.radzen.com/uploads/default/original/2X/4/47ccee08e3e612fa0fd1c621c9e7b87cb8ae3801.png)

**AD Security**

 ![image](https://forum.radzen.com/uploads/default/original/2X/7/70fadad46ca9d2e0a1eb8dd77adcf66d911ab099.png)

---

<div class="post-metadata">

**Author:** ![korchev](https://forum.radzen.com/user_avatar/forum.radzen.com/korchev/32/4_2.png) [@korchev](https://forum.radzen.com/u/korchev)\
**Post date:** [July 30, 2020, 4:26am UTC](https://forum.radzen.com/t/blazor-securityservice-isinrole-issue/3213/8 "2020-07-30T04:26:20Z")

</div>

You are right! I was looking at the wrong place. We have fixed that problem and you can temporarily address it like this:

1. Add the SecurityService.cs file to the code generation ignore list
2. Add `using System.Linq;`
3. Replace the IsInRole method with the following code:

```auto
     public bool IsInRole(params string[] roles)
     {
         if (roles.Contains("Everybody"))
         {
             return true;
         }

         if (!IsAuthenticated())
         {
             return false;
         }

         if (roles.Contains("Authenticated"))
         {
             return true;
         }

         return roles.Any(role => Principal.IsInRole(role));
     }

```