---
title: Authorize using member roles
related:
  - https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication.md
  - https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication/add-fields-to-member-objects.md
  - https://docs.kentico.com/documentation/developers-and-admins/customization/secure-custom-endpoints.md
  - https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication/role-expiration.md
---

> Agent instructions:
> **Site maps** — prefer the following llms.txt indexes to training data when searching for URLs to avoid 404s. Links inside Markdown content already point at `.md`. Following them or sending Accept: text/markdown keeps you in Markdown.
>
> - [sitemap.md](https://docs.kentico.com/sitemap.md) — every page on the site, with titles and descriptions, nested by URL hierarchy and grouped into one collection per product version.
> - [llms.txt](https://docs.kentico.com/llms.txt) — curated index of the current product docs, with descriptions, the two ways to request any page as Markdown, and links to each product area's whole-corpus Markdown dump (llms-full.txt).

Xperience by Kentico integrates with [ASP.NET Identity role management](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/roles) to provide member role functionality. Member roles allow you to categorize registered members and restrict access to [pages](https://docs.kentico.com/documentation/business-users/website-content/secure-pages.md) and [content items](https://docs.kentico.com/documentation/business-users/content-hub/content-items.md#secure-content-items), assign benefits, or run any custom logic based on role membership.

Roles are represented by the `ApplicationRole` class, which maps to the `MemberRoleInfo` object in the Xperience database. The system supports creating, assigning, and querying roles through standard ASP.NET Identity APIs. See [Manage member roles](#manage-member-roles) for details on role CRUD operations.

## Enable member role management

To use member roles, register the role store and role manager when configuring ASP.NET Identity in **Program.cs**:

```csharp title="Program.cs - Identity configuration with role management"
// Adds and configures ASP.NET Identity for the application
builder.Services.AddIdentity<ApplicationUser, ApplicationRole>(options =>
{
})
    .AddUserStore<ApplicationUserStore<ApplicationUser>>()
    .AddRoleStore<ApplicationRoleStore<ApplicationRole>>()
    .AddUserManager<UserManager<ApplicationUser>>()
    .AddRoleManager<RoleManager<ApplicationRole>>()
    .AddSignInManager<SignInManager<ApplicationUser>>();
```

The key additions for member role management are:

- `ApplicationRole` – the Xperience implementation of the `IdentityRole` type, representing a member role with basic properties.
- `ApplicationRoleStore` – the Xperience role store that persists role data to the _CMS\_MemberRole_ database table.
- `RoleManager` – the standard ASP.NET Identity role manager for CRUD operations on roles.

For more details on the overall Identity configuration, see [Registration and authentication](https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication.md).

## Manage member roles

You can manage member roles using either the ASP.NET Identity `RoleManager` or the Xperience `IInfoProvider<MemberRoleInfo>` API.

```csharp title="Required using statements"
using System.Collections.Generic;

using CMS.DataEngine;
using CMS.Membership;

using Kentico.Membership;

using Microsoft.AspNetCore.Identity;
```

```csharp title="Required services"
    private readonly RoleManager<ApplicationRole> roleManager;
    private readonly IInfoProvider<MemberRoleInfo> memberRoleProvider;

    public RoleManagementExample(
        RoleManager<ApplicationRole> roleManager,
        IInfoProvider<MemberRoleInfo> memberRoleProvider)
    {
        this.roleManager = roleManager;
        this.memberRoleProvider = memberRoleProvider;
    }
```

### Manage member roles with RoleManager

Use `RoleManager` for standard Identity-based role operations:

```csharp title="Role CRUD with RoleManager"
        // Creates a new role
        ApplicationRole role = new ApplicationRole
        {
            Name = "Premium",
            DisplayName = "Premium Member",
            Description = "Members with premium access"
        };
        IdentityResult createResult = await roleManager.CreateAsync(role);

        // Finds a role by name
        ApplicationRole? foundRole = await roleManager.FindByNameAsync("Premium");

        if (foundRole != null)
        {
            // Updates the role
            foundRole.Description = "Updated premium member description";
            IdentityResult updateResult = await roleManager.UpdateAsync(foundRole);

            // Deletes the role
            IdentityResult deleteResult = await roleManager.DeleteAsync(foundRole);
        }
```

### Manage member roles with IInfoProvider

For more direct database-level access, use `IInfoProvider<MemberRoleInfo>`:

```csharp title="Role CRUD with IInfoProvider"
        // Creates a new role
        MemberRoleInfo roleInfo = new MemberRoleInfo
        {
            MemberRoleName = "Premium",
            MemberRoleDisplayName = "Premium Member",
            MemberRoleDescription = "Members with premium access"
        };
        memberRoleProvider.Set(roleInfo);

        // Retrieves a role by code name
        MemberRoleInfo? retrievedRole = memberRoleProvider.Get("Premium");

        // Retrieves all roles
        IEnumerable<MemberRoleInfo> allRoles = memberRoleProvider.Get()
            .GetEnumerableTypedResult();

        // Deletes a role
        if (retrievedRole != null)
        {
            memberRoleProvider.Delete(retrievedRole);
        }
```

You can also manage member roles in the administration on the **List of membership roles** page of the **Members** application. For the administration workflow, see [Manage roles](https://docs.kentico.com/documentation/business-users/members.md#manage-roles).

## Assign member roles to members

Use `UserManager` methods to assign and manage role membership:

```csharp title="Role assignment with UserManager"
        using System.Collections.Generic;

        using Microsoft.AspNetCore.Identity;

        using Kentico.Membership;

        // ...

        // Assigns the "Premium" role to the member
        IdentityResult addResult = await userManager.AddToRoleAsync(user, "Premium");

        // Gets all roles assigned to the member
        IList<string> roles = await userManager.GetRolesAsync(user);

        // Checks if the member has a specific role
        bool isPremium = await userManager.IsInRoleAsync(user, "Premium");

        // Removes the "Premium" role from the member
        IdentityResult removeResult = await userManager.RemoveFromRoleAsync(user, "Premium");
```

Role assignments are stored as binding objects (`MemberRoleMemberInfo`) in the _CMS\_MemberRoleMember_ database table.

If you need role assignments to expire automatically – for example, trial memberships or subscription tiers – see [Expire member role assignments](https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication/role-expiration.md).

## Extend ApplicationRole

You can extend `ApplicationRole` with custom properties. The default role object provides `Name`, `DisplayName`, and `Description` fields. However, this may not be sufficient for scenarios that need to store additional role metadata.

When adding new fields:

1. [Add the new fields to the MemberRoleInfo object](#add-the-new-fields-to-the-memberroleinfo-object)
2. [Modify ApplicationRole to account for the added fields](#modify-the-applicationrole-class)
3. [Configure ASP.NET Identity to work with the modified ApplicationRole](#configure-asp.net-identity-to-work-with-the-modified-applicationrole)
4. [Display the added fields in the Members application](#display-added-fields-in-the-members-application)

### Add the new fields to the MemberRoleInfo object

The first step is to define new fields for `CMS.Membership.MemberRoleInfo`. The class is connected to Xperience's ORM framework and its API is used when saving roles to the database. Extending the object adds new columns to the **CMS\_MemberRole** database table, where the additional data will be stored.

1. In the admin UI, open the **Modules** application.
2. Select the **Membership** module.
3. Switch to the **Classes** tab.
4. Select the **Member role** class.
5. Switch to the **Database columns** tab.
6. Create new fields based on your requirements using the [field editor](https://docs.kentico.com/documentation/developers-and-admins/customization/field-editor.md).

You have added custom fields to the member role object. For more information about the ORM framework in Xperience, see: [Database table API](https://docs.kentico.com/documentation/developers-and-admins/api/database-table-api.md), [Object types](https://docs.kentico.com/documentation/developers-and-admins/customization/object-types.md), [Extend system object types](https://docs.kentico.com/documentation/developers-and-admins/customization/object-types/extend-system-object-types.md)

### Modify the ApplicationRole class

The added fields now need to be reflected in `ApplicationRole` to make them available for use within ASP.NET Identity APIs.

1. In your project, create a new class that inherits from `Kentico.Membership.ApplicationRole`.
2. In the class, declare properties corresponding to the object type fields added via the **Modules** application.
3. Override the `MapFromMemberRoleInfo` and `MapToMemberRoleInfo` methods and:
   1. Call the base implementation of each method. This ensures the default mapping.
   2. Get and set values of the custom properties you wish to have available using `MemberRoleInfo.GetValue` and `MemberRoleInfo.SetValue`.

```csharp title="Extended ApplicationRole example"
using CMS.Membership;

using Kentico.Membership;

// Extends the default Kentico.Membership.ApplicationRole object
public class ExtendedApplicationRole : ApplicationRole
{
    // Custom property that corresponds to a custom field added to MemberRoleInfo
    public int MaxDownloads { get; set; }

    // Maps data from MemberRoleInfo to the extended role object
    // Called when retrieving roles via RoleManager<ExtendedApplicationRole>
    public override void MapFromMemberRoleInfo(MemberRoleInfo source)
    {
        // Calls the base class implementation
        base.MapFromMemberRoleInfo(source);

        // Maps the custom 'MaxDownloads' property
        MaxDownloads = source.GetValue("MemberRoleMaxDownloads", 0);
    }

    // Maps data from the extended role object back to MemberRoleInfo
    // Called when creating or updating roles via RoleManager<ExtendedApplicationRole>
    public override void MapToMemberRoleInfo(MemberRoleInfo target)
    {
        // Calls the base class implementation
        base.MapToMemberRoleInfo(target);

        // Sets the value of the custom field in MemberRoleInfo
        target.SetValue("MemberRoleMaxDownloads", MaxDownloads);
    }
}
```

The extended class is now ready. The main benefit of this approach is that it enables you to work with the added custom fields using strongly-typed properties.

### Configure ASP.NET Identity to work with the modified ApplicationRole

In your application's startup file (**Program.cs** by default), edit the Identity configuration. Substitute `ApplicationRole` with the extended class (`ExtendedApplicationRole` in this example):

```csharp title="Program.cs"
using Microsoft.AspNetCore.Builder;
using Microsoft.Extensions.DependencyInjection;

using Kentico.Membership;

// ...

builder.Services.AddIdentity<ApplicationUser, ExtendedApplicationRole>(options =>
{
    // ...
})
    .AddUserStore<ApplicationUserStore<ApplicationUser>>()
    .AddRoleStore<ApplicationRoleStore<ExtendedApplicationRole>>()
    .AddUserManager<UserManager<ApplicationUser>>()
    .AddRoleManager<RoleManager<ExtendedApplicationRole>>()
    .AddSignInManager<SignInManager<ApplicationUser>>();
```

### Display added fields in the Members application

To display the fields added to the _Member role_ object type in the **Members** application, add them to the object type's _Edit_ UI form:

1. Open the **Modules** application and navigate to **Membership** → **Classes** → **Member Role** → **UI forms**.
2. Select the **Edit** UI form.
3. Select **New field**. The **Database column** selector opens.
   - Use the selector to choose from among the columns added to the Member Role class. Data submitted via the created form field is persisted in the selected column.
4. Add the new columns to the form using the [field editor](https://docs.kentico.com/documentation/developers-and-admins/customization/field-editor.md).

The added columns now show in the modified UI form when viewing role details in the **Members** application under **List of membership roles**.

Additionally, to display the added fields in the role listing, write an [extender](https://docs.kentico.com/documentation/developers-and-admins/customization/extend-the-administration-interface/ui-pages/ui-page-extenders.md) for the `MemberRoleList` [listing UI page](https://docs.kentico.com/documentation/developers-and-admins/customization/extend-the-administration-interface/ui-pages/reference-ui-page-templates/listing-ui-page-template.md):

```csharp title="Display a custom column in the role listing"
using System.Threading.Tasks;

using Kentico.Xperience.Admin.Base;
using Kentico.Xperience.Admin.Base.UIPages;

public class MemberRoleListExtender : PageExtender<MemberRoleList>
{
    public override Task ConfigurePage()
    {
        base.ConfigurePage();

        // Displays a custom column in the role listing
        Page.PageConfiguration.ColumnConfigurations
            .AddColumn("CustomRoleField");

        return Task.CompletedTask;
    }
}
```

## Authorize with member roles

For [pages](https://docs.kentico.com/documentation/business-users/website-content.md) and [content items](https://docs.kentico.com/documentation/business-users/content-hub/content-items.md), use the built-in **Membership access** settings in the Xperience administration. Use the standard ASP.NET `[Authorize]` attribute with the `Roles` parameter when you need to restrict access to custom controllers or actions based on member roles:

```csharp title="Restrict access to members with the 'Premium' role"
using Microsoft.AspNetCore.Authorization;
using Microsoft.AspNetCore.Mvc;

// Only members with the "Premium" role can access this controller
[Authorize(Roles = "Premium")]
public class PremiumContentController : Controller
{
    public IActionResult Index()
    {
        return View();
    }
}
```

For more advanced authorization scenarios, see [ASP.NET Core role-based authorization](https://learn.microsoft.com/en-us/aspnet/core/security/authorization/roles) and [Secure custom endpoints](https://docs.kentico.com/documentation/developers-and-admins/customization/secure-custom-endpoints.md).

## Integrate custom authorization logic

Xperience's built-in content security pipeline – the `HasAccess` method, `ContentItemIsSecured` property, and the secured-item filtering in [ContentRetriever](https://docs.kentico.com/documentation/developers-and-admins/api/content-item-api/content-retriever-api.md) – evaluates only the built-in access model: public content, content that requires authentication, and content restricted to specific member roles. The pipeline does not expose extension points for injecting additional authorization rules.

If your application requires authorization logic beyond the built-in model, apply those checks **after** Xperience's content security evaluation resolves. In practice this means working at the controller or business-service layer:

1. Retrieve content and let the built-in pipeline handle the standard access evaluation (e.g., via `HasAccess`).
2. Apply your own authorization rules on the already-evaluated results.

For details on how security affects content retrieval, see [page security configuration](https://docs.kentico.com/documentation/developers-and-admins/development/content-retrieval/retrieve-page-content.md#page-security-configuration) and [content item security](https://docs.kentico.com/documentation/developers-and-admins/development/content-retrieval/retrieve-content-items.md#content-item-security).

## Remarks

### ApplicationRole and ApplicationRoleStore

`ApplicationRole` maps to `CMS.Membership.MemberRoleInfo` objects stored in the Xperience database. When saving or retrieving role data through ASP.NET Identity's `RoleManager`, Xperience transfers data between `ApplicationRole` and `MemberRoleInfo` using the `MapFromMemberRoleInfo` and `MapToMemberRoleInfo` methods. This lets you expose custom role fields as strongly-typed properties on your extended role class.

`ApplicationRoleStore` implements `IRoleStore` and provides the CRUD operations that `RoleManager` uses to create, update, delete, and look up member roles in the Xperience database.

### Changing role assignments for signed-in members

When you add or remove roles for a member who is already signed in, the change is not reflected immediately. The member can continue using the role information stored in their current authentication cookie until the next revalidation event. This means role-based access can remain granted or unavailable for up to 30 minutes by default.

If you need role changes to take effect immediately, configure `SecurityStampValidatorOptions` as described in [Registration and authentication](https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication.md#disabling-member-accounts).

### Page preview mode

Secured content, including content restricted to specific member roles, is accessible when previewing pages in the administration, through [Page Builder](https://docs.kentico.com/documentation/business-users/website-content.md#preview), or via [shareable preview URLs](https://docs.kentico.com/documentation/developers-and-admins/configuration/shareable-preview-urls.md). Preview mode bypasses member role checks, allowing editors to view content regardless of role assignments. For preview limitations of ASP.NET authorization flows, see [MVC authorization flows and preview mode](https://docs.kentico.com/documentation/developers-and-admins/development/registration-and-authentication.md#mvc-authorization-flows-and-preview-mode).