c# - MVC Not holding on to authentication -

i have 2 apps i'm working on. both of them need use both windows authentication , anonymous access. this, edited web.config rid of authorization tag (with "deny users="?"") , tagged few actions custom authorization attribute. trouble is, server "forgetting" me. instance, on first app, 1 user reports has attempt access control panel every other time wants edit. on second one, click login, i'm logged in, , click other link (especially "save") , i'm logged out.

here's 1 of custom authorization attributes:

public class accountsauthorizeitattribute : authorizeattribute {     protected override bool authorizecore(httpcontextbase httpcontext)     {         if(httpcontext.user.identity.isauthenticated == false)         {             return false;         }          if(httpcontext.user.isinrole("ct-it"))         {             return true;         }          return false;     } } 

and log in, have in _layout:

@html.actionlink("login", "login", "login", new { returnurl = httpcontext.current.request.rawurl }, null) 

with login controller:

public class logincontroller : controller {     [accountsauthorizeit]     public actionresult login(string returnurl)     {         return redirect(returnurl);     } } 

what cause this? shouldn't authentication stored in session variable, saved (roughly) long browser window open? need tell server remember data?

shouldn't authentication stored in session variable, saved (roughly) long browser window open? need tell server remember data?

i store them in principle object claim using owin cookie middleware.

here sample code. rolenames user's assigned active directory group.

public void signin(user user, ilist<string> rolenames) {     ilist<claim> claims = new list<claim>             {                 new claim(claimtypes.sid, user.id.tostring()),                 new claim(claimtypes.name, user.username),                 new claim(claimtypes.givenname, user.firstname),                 new claim(claimtypes.surname, user.lastname),             };      foreach (string rolename in rolenames)     {         claims.add(new claim(claimtypes.role, rolename));     }      claimsidentity identity = new claimsidentity(claims, authenticationtype);      iowincontext context = _context.request.getowincontext();     iauthenticationmanager authenticationmanager = context.authentication;      authenticationmanager.signin(identity); } 

startup.cs

then register owin cookie middleware @ start up.

public class startup {     public void configuration(iappbuilder app)     {         app.usecookieauthentication(new cookieauthenticationoptions         {             authenticationtype = "applicationcookie",             loginpath = new pathstring("/account/login")         });     } } 

if store them in principle object, won't need custom attribute accountsauthorizeitattribute.