A claim is a typed piece of information about an authenticated user. In the board-game API, claims travel in the user’s JSON Web Token (JWT). The authorization process reads them to decide whether a request meets an endpoint’s access rules. section 9.2.6 section 9.4.4
Start with the login flow. After checking the username and password, the Login action creates a list of claims. Its first claim uses ClaimTypes.Name and the user’s UserName. The action then combines the claims with signing credentials, issuer, audience, and expiration time to create a JWT. It returns the token string so the client can send it in the Authorization header on later requests. section 9.2.6
A name claim identifies the user, but it does not say whether that user is a moderator or administrator. For role-based access control, add a ClaimTypes.Role claim for each role returned by UserManager.GetRolesAsync(user). A user’s token can therefore have no role claims, one, or several. Authorization rules on controllers or actions can then check those roles. section 9.4 section 9.4.4
// ... existing code
var claims = new List<Claim>();
claims.Add(new Claim(
ClaimTypes.Name, user.UserName));
claims.AddRange(
(await _userManager.GetRolesAsync(user))
.Select(r => new Claim(ClaimTypes.Role, r)));
// ... existing code
The login snippet keeps the name claim and turns each assigned role into a separate role claim. section 9.4.4
Role is only one possible claim type. A requirement could also check for ClaimTypes.MobilePhone. This is claims-based access control: it can test a claim or a combination of claims, while role-based access control checks the role claim. Role requirements can use the Roles property of [Authorize]; other claim requirements need a policy registered in Program.cs. section 9.4.7
Require a moderator with a mobile-phone claim
Register a policy that requires both the Moderator role claim and the presence of a mobile-phone claim, then put [Authorize(Policy = "ModeratorWithMobilePhone")] on the protected action. For this to work, registration must accept and save the phone number, and login must add its claim when the number is present. This is an extension to implement, not a claim supplied by the role-only login flow. section 9.4.7
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("ModeratorWithMobilePhone", policy =>
policy
.RequireClaim(ClaimTypes.Role, RoleNames.Moderator)#1
.RequireClaim(ClaimTypes.MobilePhone)); #2
});
The policy configuration shows how RequireClaim combines a specific role value with the presence of another claim type. section 9.4.7
