Claims-based access control (CBAC) authorizes an authenticated user by checking claims attached to that user, including claim values when needed. A claim can represent a role, mobile-phone number, date of birth, or another relevant property. Role-based access control (RBAC) is effectively a simpler CBAC form that checks only the role claim. section 9.4.7
Implement CBAC through named authorization policies:
- Declare each policy explicitly in Program.cs because claim requirements are policy-based rather than exposed through the Authorize attribute’s Role property. section 9.4.7
- Combine requirements such as the Moderator role and the presence of a mobile-phone claim in one policy. section 9.4.7
- Apply the named policy to an endpoint with [Authorize(Policy = "ModeratorWithMobilePhone")]. section 9.4.7
- Support the policy by accepting and storing the mobile-phone value, then conditionally adding it to the JWT as a claim during login. section 9.4.7
builder.Services.AddAuthorization(options =>
{
options.AddPolicy("ModeratorWithMobilePhone", policy =>
policy
.RequireClaim(ClaimTypes.Role, RoleNames.Moderator)#1
.RequireClaim(ClaimTypes.MobilePhone)); #2
});
The policy configuration shows how CBAC requires both a specific role claim and a mobile-phone claim before authorization succeeds. section 9.4.7
Checking a minimum age
A policy can use a custom assertion instead of only checking claim presence. The MinAge18 example requires a date-of-birth claim, parses its value, compares it with the current date, and protects an endpoint through [Authorize(Policy = "MinAge18")]. section 9.4.7
