关于身份验证与授权的问题

我是按照这上面的例子来做的.
http://www.microsoft.com/china/msdn/library/architecture/architecture/architecturetopic/BuildSucApp/BSSAsecmodsecmod18.mspx?mfr=true
可是当我测试的时候,那个都是说不在此权限中.请问这是为什么啊?
这个是CustomPrincipal类:
public class CustomPrincipal : IPrincipal
{
protected IIdentity identity;
private string[] role;
public CustomPrincipal()
{
//
// TODO: 在此处添加构造函数逻辑
//
}
public CustomPrincipal(IIdentity identity, string roles)
{
this.identity = identity;
role = roles.Split(new char[]{'|'});
}
public CustomPrincipal(IIdentity identity, string [] role )
{
this.identity = identity;
this.role = role;
}
public IIdentity Identity
{
get
{
return this.identity;
}
}
public bool IsInRole(string role)
{
return (System.Array.IndexOf(this.role,role) > -1 );
}
}然后这是在Application_AuthenticateRequest中的方法:
protected void Application_AuthenticateRequest(Object sender, EventArgs e)
{
string cookieName = FormsAuthentication.FormsCookieName;
HttpCookie authCookie = Context.Request.Cookies[cookieName];
if( null == authCookie )
{
return ;
}
FormsAuthenticationTicket ticket = null;
try
{
ticket = FormsAuthentication.Decrypt( authCookie.Value );
}
catch(Exception ex)
{
return ;
}
if( null == ticket )
{
return ;
}
string[] roles  = ticket.UserData.Split(new char[] {'|'});
FormsIdentity id = new FormsIdentity(ticket);
CustomPrincipal principal = new CustomPrincipal(id, roles);
Context.User = principal;
}然后这是在登陆页中提交的代码:private void btnOk_Click(object sender, System.EventArgs e)
{
string roles = String.Empty;
bool isAuthenticated = this.IsAuthenticated(this.txtUserName.Text, this.txtUserPass.Text);
if(isAuthenticated == true )
{
roles = this.GetRoles(this.txtUserName.Text, this.txtUserPass.Text );
}
FormsAuthenticationTicket ticket = new FormsAuthenticationTicket(1,this.txtUserName.Text,DateTime.Now,DateTime.Now.AddHours(1),false,roles);
string encryptedTicket = FormsAuthentication.Encrypt( ticket );
HttpCookie authCookie = new HttpCookie( FormsAuthentication.FormsCookieName, encryptedTicket );
Response.Cookies.Add( authCookie );
FormsAuthentication.RedirectFromLoginPage( this.txtUserName.Text, true );
}                 private bool IsAuthenticated(string userName, string password )
{
return true;
}
private string GetRoles(string userName, string password )
{
string roles="Manager|Employee";
return roles;
}最后这是测试页default.aspx:
private void Page_Load(object sender, System.EventArgs e)
{
// 在此处放置用户代码以初始化页面
IPrincipal p = HttpContext.Current.User;
Response.Write("Authenticated identity is :" + p.Identity.Name);
Response.Write("<p>");
if(p.IsInRole("Manager") )
Response.Write(" User is in Manager role<p>" );
else
Response.Write("User is not in Manager role<p>");
                }我在WEB.CONFIG中配置如下:
<authentication mode="Forms" > 
<forms name="test" loginUrl ="login.aspx" protection="All" path="/" />
</authentication><authorization>
        <deny users="?" />
</authorization>