I'm trying to integrate the security of a DNN portal and an external system. The external system is already set up to check for role membership using the IPrincipal scheme. It appears that DNN does not completely populate the user context because the following code always returns False no matter what value is used for rolename:

HttpContext.Current.User.IsInRole("rolename")

For the life of me I can't find where in the DNN core the User property of HttpContext.Current is set, despite having been through all the code associated with logging in, and the roles stuff in the MembershipModule HttpModule. I would like to see the code to understand what I would be interfering with if I were to set it myself, for example in a custom membership provider.

Does anyone know where in the core this property gets set?

Has anyone every tried manipulating it?

Thanks for the response, but I'm trying to get the existing code outside of DNN to work as is.

I've managed to do it, so I document that here in case anyone else wants to know.

Firstly, the question wasn't a particularly good one. ASP.NET ITSELF manages HttpContext.Current.User, persisting User.Name and User.IsAuthenticated between page cycles using the security token it saves in a cookie. However, it does not persist role memberships, so that is all you have to add for this to work.

I created an extremely simple HttpModule to populate the roles on each request from data that DotNetNuke makes available. This is simply a case of a line like the following:

HttpContext.Current.User = New GenericPrincipal(HttpContext.Current.User, UserController.GetCurrentUserInfo.Roles)

Then any tests on HttpContext.Current.User.IsInRole("rolename") work perfectly.