ASP.NET 5 Authorize against two or more policies

c# asp.net-core authorization asp.net-core-mvc
painiyff picture painiyff · Feb 24, 2016 · Viewed 31k times · Source

Is it possible to apply authorization against two or more policies? I am using ASP.NET 5, rc1.

[Authorize(Policy = "Limited,Full")]
public class FooBarController : Controller
{
    // This code doesn't work
}

If not, how may I achieve this without using policies? There are two groups of users that may access this controller: "Full" and "Limited". Users may either belong to "Full" or "Limited", or both. They only require to belong to one of the two groups in order to access this controller.

Answer

blowdart picture blowdart · Feb 24, 2016

Not the way you want; policies are designed to be cumulative. For example if you use two separate attributes then they must both pass.

You have to evaluate OR conditions within a single policy. But you don't have to code it as ORs within a single handler. You can have a requirement which has more than one handler. If either of the handlers flag success then the requirement is fulfilled. See Step 6 in my Authorization Workshop.

Related questions

How do you create a custom AuthorizeAttribute in ASP.NET Core?

I'm trying to make a custom authorization attribute in ASP.NET Core. In previous versions it was possible to override bool AuthorizeCore(HttpContextBase httpContext). But this no longer exists in AuthorizeAttribute. What is the current approach to make a custom …

Read More
Token Based Authentication in ASP.NET Core (refreshed)

I'm working with ASP.NET Core application. I'm trying to implement Token Based Authentication but can not figure out how to use new Security System. My scenario: A client requests a token. My server should authorize the user and return …

Read More
Authorization in ASP.NET Core. Always 401 Unauthorized for [Authorize] attribute

For the first time I'm creating Authorization in ASP.NET Core. I used tutorial from here TUTORIAL The problem is when I sending request from postman: Authorization:Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6I... to my method in controller decorated with [Authorize] …

Read More