Get multiple rows back from SqlDatareader

The OPs code above will not work because C# is not an "indent" language. A While statement will work, but without brackets it will only execute the next line of code. Putting the While block in curly braces would define the code that will be executed within that block.

List<string> roles;
var conn = @"Server=Myserver;Database=Mydatabase;Trusted_Connection=True;";

using (var con = new SqlConnection(conn))
using (SqlCommand cmd = new SqlCommand("[Web].Get_User_Roles"))
{
    cmd.CommandType = CommandType.StoredProcedure;
    cmd.Parameters.Add("@Username", SqlDbType.NVarChar);
    cmd.Parameters["@Username"].Value = userName;
    cmd.Connection = con;
    con.Open();

    using(SqlDataReader reader = cmd.ExecuteReader())
    {
        roles = new List<string>();
        while (reader.Read())
        {
            var role = reader["Roles"].ToString();
            roles.Add(role);
        }

        //con.Close(); —- this is redundant because the using block will take care of Close and Dispose!
    } //Close and Dispose of the SqlDataReader
} //Close and Dispose of SqlCommand and SqlConnection

NOTE:
I wish not to deviate too far from the OPs original code. I tend to do things a bit differently. At the very least I would not use a simple List<string> to hold my results since only having the “role” might not have much use. But, I do not know the requirements.

Simple suggestion:
— The code could be made Asynchronous by changing ExecuteReader() into ExecuteReaderAsync() and Read() into ReadAsync():: in general not a bad idea for calls to DBs.
— I generally add a CommandTimeout, but this might have been omitted in order to make the code easier to understand for the sake of the question statement.

Try this:

        FormsAuthentication.Initialize();
        List<string> roles = new List<string>()
        var conn = @"Server=Myserver;Database=Mydatabase;Trusted_Connection=True;";

        using (var con = new SqlConnection(conn))
        {
            using (SqlCommand cmd = new SqlCommand("[Web].Get_User_Roles"))
            {
                cmd.CommandType = CommandType.StoredProcedure;
                cmd.Parameters.Add("@Username", SqlDbType.NVarChar);
                cmd.Parameters["@Username"].Value = userName;
                cmd.Connection = con;
                con.Open();
                SqlDataReader reader = cmd.ExecuteReader();

                while (reader.Read())
                {
                    var role = reader["Roles"].ToString();
                    roles.Add(role);
                }
                con.Close();

            }
        }

You're using raw ADO.NET to get data from your database. That's okay, it's certainly helpful to learn raw ADO.NET. But the syntax is overly complicated, and a micro-ORM such as Dapper can make it significantly easier.

const string connectionString = @"Server=Myserver;Database=Mydatabase;Trusted_Connection=True;";

using (var con = new SqlConnection(connectionString))
{
    List<string> roles = con.Query<string>("[Web].Get_User_Roles", new { Username = userName}, commandType: CommandType.StoredProcedure);
    return roles;
}

A lot of suggestions in this thread, but what I was looking for was this. It's very sloppy code, but it gets me my answer and if need be I can explain in detail. Here is the code. I needed to pull both roles that I was enabled to have in according to my SQL Stored Procedure. Here was my Result and C# Code to make it work the way I needed too.

string role = string.Empty;

            var conn = @"Server=lol;Database=Did;Trusted_Connection=True;";

            using (var con = new SqlConnection(conn))

            using (SqlCommand cmd = new SqlCommand("[Web].Get_User_Roles"))
            {
                cmd.CommandType = CommandType.StoredProcedure;
                cmd.Parameters.Add("@Username", SqlDbType.NVarChar);
                cmd.Parameters["@Username"].Value = userName;
                cmd.Connection = con;
                con.Open();

                using (SqlDataReader reader = cmd.ExecuteReader())
                {

                    reader.Read();
                    role = reader["Roles"].ToString();
                    while (reader.Read())

                    {

                        role = role + " , " + reader["Roles"].ToString();


                    }

                }
            }

Is it dirty code? Yes, I can definitely clean it up a bit. But, I get the result I was looking for. I didn't need to list, just to concatenate the results which gave me my answer.