ClaimsPrincipal is a .NET identity object representing the current user or caller through one or more claims-based identities. Authorization policies can inspect its claims, check their presence or values, and transform or convert those values for policy decisions. section 9.4.7
RequireAssertion exposes the current ClaimsPrincipal through AuthorizationHandlerContext, allowing an anonymous policy function to make custom authorization checks. More elaborate policy-based authorization can use requirements and authorization handlers. section 9.4.7
options.AddPolicy("MinAge18", policy =>
policy
.RequireAssertion(ctx =>
ctx.User.HasClaim(c => c.Type == ClaimTypes.DateOfBirth)
&& DateTime.ParseExact(
"yyyyMMdd",
ctx.User.Claims.First(c =>
c.Type == ClaimTypes.DateOfBirth).Value,
System.Globalization.CultureInfo.InvariantCulture)
>= DateTime.Now.AddYears(-18)));
A minimum-age policy reads a date-of-birth claim from ctx.User, parses its value, and checks whether the user is at least 18. section 9.4.7
