You need to be in either the VisitorGroupAdmins or CmsAdmins role. By default the CmsAdmins role is configured as a mapped virtual role. Check your EPiServerFramework.config and add this to the virtual role provider if it's not there:

<add roles="WebAdmins, Administrators" mode="Any" name="CmsAdmins"
        type="EPiServer.Security.MappedRole, EPiServer.Framework" />

You can of course add a mapped role for VisitorGroupAdmins as well, or create the role in you role provider.

Thanks, that worked!

I've moved on to upgrading the next site. On this one the "EPiServer Deployment Center" doesn't hang but the admin stops working after the upgrade... with this exception, any ideas?

(sorry for the deleted message, thought I had a lead by the file path in the stack, but it points to episervers file) :)

Unable to cast object of type 'EPiServer.Security.VirtualRolePrincipal' to type 'System.Web.Security.RolePrincipal'.



[InvalidCastException: Unable to cast object of type 'EPiServer.Security.VirtualRolePrincipal' to type 'System.Web.Security.RolePrincipal'.]
   ASP.admin_shell_views_shared_site_master.__RenderHideCMSTab(HtmlTextWriter __w, Control parameterContainer) in C:\...\admin\Shell\Views\Shared\Site.Master:48
   System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) +131
   System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) +246
   System.Web.UI.HtmlControls.HtmlHead.RenderChildren(HtmlTextWriter writer) +27
   System.Web.UI.HtmlControls.HtmlContainerControl.Render(HtmlTextWriter writer) +48
   EPiServer.UI.WebControls.ControlAdapters.HtmlHeadAdapter.Render(HtmlTextWriter writer) +1026
   System.Web.UI.Control.RenderControlInternal(HtmlTextWriter writer, ControlAdapter adapter) +11333554
   System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) +246
   System.Web.UI.Control.RenderChildrenInternal(HtmlTextWriter writer, ICollection children) +246
   System.Web.Mvc.ViewPage.Render(HtmlTextWriter writer) +85
   System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +5290

Is it perhaps some customization in Site.master? It seems to contain code that expects the (current?) principal to be of type RolePrincipal, which it won't be when VirtualRoles are activated.

The error occurs before any of our code is executed, in EPiServer. By following "The Select Isn't broken"-paradigm, there must be some kind of configuration error in our site (or some configuration that no longer works after the upgrade). Only, I'dont really have anything to go on...  

The old paradigm was correct. Found some configuration remapping that url to another file. (didn't build the site that's why i'm a bit confused).

Thank's for your help!

My EPiServerFramework.config has the following tags :

  <virtualRoles replacePrincipal="true">
    <providers>
      <add name="Administrators" type="EPiServer.Security.WindowsAdministratorsRole, EPiServer" />
      <add name="Administrator" type="EPiServer.Security.WindowsAdministratorsRole, EPiServer" />
      <add name="Everyone" type="EPiServer.Security.EveryoneRole, EPiServer" />
      <add name="Authenticated" type="EPiServer.Security.AuthenticatedRole, EPiServer" />
      <add name="Anonymous" type="EPiServer.Security.AnonymousRole, EPiServer" />
      <add name="Creator" type="EPiServer.Security.CreatorRole, EPiServer" />
      <add roles="WebAdmins, Administrators" mode="Any" name="CmsAdmins"
       type="EPiServer.Security.MappedRole, EPiServer.Framework" />
      <add roles="WebAdmins, Administrators" mode="Any" name="VisitorGroupAdmins"
      type="EPiServer.Security.MappedRole, EPiServer.Framework" />
      <add roles="WebEditors" mode="Any" name="CmsEditors" type="EPiServer.Security.MappedRole, EPiServer.Framework" />
    </providers>
  </virtualRoles>

And still I don't have access to the Visitor Groups (admin/edit/dashboard is working), this is after an upgrade, does someone have an idea?

Thanks!

The problem was that we had in our CMS5R2 web.config this tag :

<add name="InitializationModule" type="EPiServer.Web.InitializationModule, EPiServer" />

The deployement center didn't touch this but we changed it to the new one :

<add name="InitializationModule" type="EPiServer.Framework.Initialization.InitializationModule, EPiServer.Framework" />

 After this change we could access the visitor groups UI.