Declarative check not returning same results as direct role check?

From: Joshua Freeman (jofree@nospamalias.com)
Date: 02/18/03


From: "Joshua Freeman" <jofree@nospamalias.com>
Date: Tue, 18 Feb 2003 13:46:52 -0800


I'm trying to implement .Net role based security on some
of my ASP.Net code. I am setting the HttpContext.User to a
custom class which implements IPrincipal. I'm setting this
in the Application_PreRequestHandlerExecute event handler
in the Global.asax.cs file.

In the following code the if statment condition returns
true, but the permCheck.Demand() statment throws a
security exception.

if (this.User.IsInRole("TestApplication1")) {
   this.Trace.Write("Is Authorized");
}
else {
   this.Trace.Write("Not Authorized");
}
PrincipalPermission permCheck = new PrincipalPermission
(null, "TestApplication1");
permCheck.Demand();

I thought that the two methods used here both use the same
IsInRole method of the IPrincipal interface defined on the
current HttpContext.User. Is this not correct? Am I
missing something?