Enterprise Application Architecture with .NET Core

Filtering based on policy

Policy-based authorization is a little different than the first two. In this first step, you have to define a policy and then use it with the AuthorizationAttribute. Policies can be configured in the ConfigureServices method in the Startup class, and they can be used to define any criteria on user claims:

    services.AddAuthorization(options =>     {         options.AddPolicy("RequireManagerRole", policy =>          policy.RequireRole("Manager"));     });

And we can use the RequireManagerRole policy as follows:

    [Authorize(Policy ="RequireManagerRole")]     [HttpGet]     public List<Employee> Get()     {         return GetEmployees();     }

Another example is by reading user claims. For example, if we only allow users to access the EmployeeController, if ...