A claim is one piece of information about a user principal: a claim type and an optional value. A principal may carry claims such as email, name, or HasAdminAccess. In ASP.NET Core, the current principal is available through HttpContext.User; before authentication, it is anonymous and has no claims. section 23.1.1
Authentication establishes who made a request. Authorization then decides what that user may do. Claims can supply user details for display or information for that decision; having a claim does not grant access unless an authorization rule requires it. section 24.1 section 24.3
Add and read a user detail
To collect a friendly name during registration, add a Name field to the form, create a Claim("FullName", Input.Name), and call UserManager.AddClaimAsync(user, claim). A Razor Page or view can read it with User.FindFirstValue("FullName"). A permissions claim can instead be added to an existing user through an administrative UI. section 23.6
ASP.NET Core Identity stores claims associated with users in AspNetUserClaims. Roles can also have claims that a user principal effectively inherits. For an editable profile property, adding a property to the Identity user entity may be easier than storing it as a claim. section 23.3.3 section 23.6
A policy turns claims into an access requirement. For example, RequireClaim("BoardingPassNumber") requires that claim; a policy can also require one of specified values. Apply the named policy to a Razor Page with [Authorize("CanEnterSecurity")]. An authenticated user missing the required claim is denied access, rather than sent to log in. section 24.3 section 24.2.2
Listing 24.4 Adding an authorization policy using AuthorizationPolicyBuilder
WebApplicationBuilder builder = WebApplication.CreateBuilder(args);
builder.Services.AddAuthorizationBuilder() #1
.AddPolicy( #2
"CanEnterSecurity", #3
policyBuilder => policyBuilder #4
.RequireClaim("BoardingPassNumber")); #4
});
// Additional configuration
The policy configuration shows where RequireClaim supplies the requirement later named by [Authorize]. section 24.3
Claims also travel in API bearer tokens. A JWT carries them in its payload; after token validation, authentication middleware creates a ClaimsPrincipal for HttpContext.User. Always validate a received JWT’s signature so its claims cannot simply be altered. section 25.2
