The GenericPrincipal constructor requires an array of roles for IsInRole to work. If null is passed in for that, then it will always return false, even if role claims are present on its identities.