Force claim on user

I integrated with and old Active Directive through LDAP, where some users are to be looked up. If I find the user, it should have access - no additional requirements.

I have a specific page, which I have placed a restriction on, so that only user from MyGroup can see. When I go to the site, I get redirected to my Login-page and get a nice ReturnUrl, but I get a 401 back for the page. EPiServer refuses to let me in, although I can see I actual get my user.

How can I tell EPiServer, that a given user is allowed access?

I created my own LoginController, which calls a method like this:

public AuthenticationResult SignInAsLdapUser(string username, string password)
{
    var principalContext = new PrincipalContext(/*...*/);
    isAuthenticated = principalContext.ValidateCredentials(username, password);
    if (!isAuthenticated)
        return;

    var userPrincipal = UserPrincipal.FindByIdentity(principalContext, username);

    //Attempt to force additional claims on user
    var identity = new ClaimsIdentity(DefaultAuthenticationTypes.ApplicationCookie, ClaimsIdentity.DefaultNameClaimType, ClaimsIdentity.DefaultRoleClaimType);
    identity.AddClaim(new Claim(ClaimTypes.Role, "MyGroup")); //Group I am trying to add

    HttpContext.Current.GetOwinContext().Authentication.SignOut(DefaultAuthenticationTypes.ApplicationCookie);
    HttpContext.Current.GetOwinContext().Authentication.SignIn(new AuthenticationProperties
    {
        IsPersistent = true,
        ExpiresUtc = DateTimeOffset.Now.AddMinutes(30),
        AllowRefresh = true

    }, identity);

    return new AuthenticationResult();
}

in my web.config I specified the group MyGroup:

<virtualRoles addClaims="true">
    <providers>
        ...
        <add name="CmsEditors" type="EPiServer.Security.MappedRole, EPiServer.Framework" roles="MyGroup, ..." mode="Any"/>
        ...
    </providers>
</virtualRoles>

In my startup.cs I specified the built-in Identity and cookies:

public void Configuration(IAppBuilder app)
{
    app.AddCmsAspNetIdentity<ApplicationUser>(); //OWIN from EPiServer
    
    app.UseCookieAuthentication(new CookieAuthenticationOptions
    {
        AuthenticationType = DefaultAuthenticationTypes.ApplicationCookie,
        AuthenticationMode = AuthenticationMode.Active,
        CookieSecure = CookieSecureOption.Always,
        LoginPath = new PathString("/Login"),
        CookieName = "MyCookie",
        ExpireTimeSpan = TimeSpan.FromDays(7),
        ReturnUrlParameter = "ReturnUrl",
        Provider = new CookieAuthenticationProvider
        {
            OnValidateIdentity = SecurityStampValidator
                .OnValidateIdentity<ApplicationUserManager<ApplicationUser>, ApplicationUser>(
                    validateInterval: TimeSpan.FromMinutes(30),
                    regenerateIdentity: (manager, user) => manager.GenerateUserIdentityAsync(user)),
            OnApplyRedirect = context => context.Response.Redirect(context.RedirectUri),
            OnResponseSignIn = context => context.Response.Redirect(GetReturnUrl()),
        }
    });

    app.UseStageMarker(PipelineStage.Authenticate);
    
    AntiForgeryConfig.UniqueClaimTypeIdentifier = ClaimTypes.Name;
}