.NET Core 2.0 By Example

Role-based authorization

When a ClaimsPrincipal object is created, like we did previously, there is a property called IsInRole. This property provides us access to the Roles of the user. Role-based authorization checks are declarative. They can be used in the same way, using the [Authorize] attribute that we have seen, by passing in the Roles parameter:

[Authorize(Roles = "Administrator,ITAdminsitrator")]public class UserAdministrationController : Controller{     ….}

In the preceding example, all the actions of UserAdministrationController are accessible to authenticated users with either the Adminsitrator or ITAdministrator roles. So, we can provide multiple roles as comma-separated values in the Roles parameter and they will be treated as ...