asp. net core authorization details

The IAuthorizeDate interface represents the source of the authorization system:

public interface IAuthorizeData
{
  string Policy { get; set; }
  string Roles { get; set; }
  string AuthenticationSchemes { get; set; }
}

The three attributes defined in the interface represent the three authorization types:

1. Role-based authorization:

[Authorize(Roles = "Admin")] //  Multiple Role You can use the , Segmentation 
public class SampleDataController : Controller
{
  ...
}

2. Authorization based on scheme:

[Authorize(AuthenticationSchemes = "Cookies")] //  Multiple Scheme You can use the , Segmentation 
public class SampleDataController : Controller
{
  ...
}

3. Policy-based authorization:

[Authorize(Policy = "EmployeeOnly")]
public class SampleDataController : Controller
{
  
}

Policy-based authorization is the core of authorization. When using this authorization policy, you must first define the policy:

public void ConfigureServices(IServiceCollection services)
{
  services.AddMvc();

  services.AddAuthorization(options =>
  {
    options.AddPolicy("EmployeeOnly", policy => policy.RequireClaim("EmployeeNumber"));
  });
}

The authorization policy is essentially a series 1 assertion of claims.

Both role-based and scheme-based authorization are syntactic sugars, which will eventually be converted into policy authorization.

The above is the knowledge points about asp. net core authorization. If you have any questions, you can contact this site.