Policy-based access control (PBAC) authorizes a user by evaluating configurable policies built from requirements and handlers. It suits checks more complex than verifying whether a claim exists or has one specific value, such as requiring an age of at least 18. section 9.4.7
A practical PBAC implementation follows this pattern:
- Declare a named policy in Program.cs with one or more requirements. section 9.4.7
- Use built-in requirements such as RequireClaim when claim presence and values are sufficient. section 9.4.7
- Use RequireAssertion for an inline predicate, or implement IAuthorizationRequirement and IAuthorizationHandler for reusable custom logic. section 9.4.7
- Apply the policy to an endpoint with [Authorize(Policy = "PolicyName")]. section 9.4.7
Require moderators to have mobile-phone claims
A named policy can require both a moderator role claim and a mobile-phone claim: AddAuthorization registers "ModeratorWithMobilePhone", and [Authorize(Policy = "ModeratorWithMobilePhone")] protects the endpoint. A more complex "MinAge18" policy can use RequireAssertion to verify a date-of-birth claim and compare the parsed date with the current date minus 18 years. section 9.4.7
options.AddPolicy("MinAge18", policy =>
policy
.RequireAssertion(ctx =>
ctx.User.HasClaim(c => c.Type == ClaimTypes.DateOfBirth)
&& DateTime.ParseExact(
"yyyyMMdd",
ctx.User.Claims.First(c =>
c.Type == ClaimTypes.DateOfBirth).Value,
System.Globalization.CultureInfo.InvariantCulture)
>= DateTime.Now.AddYears(-18)));
Inspect the inline MinAge18 assertion, including its date-of-birth claim check and date comparison. section 9.4.7
