Role-based access control (RBAC) grants permissions to groups of users rather than treating every authenticated user alike. A role acts as a group: assign users to it, define its authorization rules, and those rules apply to its members. This matters when a public board-game API must allow reading while restricting changes to its data. section 9.4 section 9.0
A useful permission split has three user types. Basic users can read but cannot change data. Moderators can read and update, but cannot delete or seed the database. Administrators can read, update, delete, and seed. A plain `[Authorize]` check distinguishes authenticated users from anonymous callers; it does not distinguish these three permission levels. section 9.4
To implement that split with ASP.NET Core Identity and JSON Web Tokens (JWTs):
- Register test accounts for a moderator and an administrator, then create the `Moderator` and `Administrator` roles. Basic users need no additional role for this permission scheme. section 9.4
- Assign each account its role. Add the user’s roles to the claims in the JWT issued at login so authorization can recognize them. section 9.4
- Put role requirements on protected endpoints with `[Authorize(Roles = ...)]`. A matching role claim in the caller’s JWT satisfies the requirement. section 9.4 section 9.4.7
app.MapGet("/auth/test/2",
[Authorize(Roles = RoleNames.Moderator)]
[EnableCors("AnyOrigin")]
[ResponseCache(NoStore = true)] () =>
{
return Results.Ok("You are authorized!");
});
app.MapGet("/auth/test/3",
[Authorize(Roles = RoleNames.Administrator)]
[EnableCors("AnyOrigin")]
[ResponseCache(NoStore = true)] () =>
{
return Results.Ok("You are authorized!");
});
These two harmless Minimal API endpoints make the rule visible: one requires `Moderator`, and the other requires `Administrator`. They allow permission tests without changing stored data. section 9.4.6
Check each role in SwaggerUI
Log in as a user with no role, supply the JWT through SwaggerUI’s Authorize button, and call both test endpoints: neither should succeed. Repeat as a moderator: only the moderator endpoint should return `200 OK`. Repeat as an administrator assigned both roles: both should return `200 OK`. The described test expects `401 Unauthorized` for the unsuccessful calls. section 9.4.6
RBAC checks the `ClaimTypes.Role` claim. If access must also depend on another claim, such as the presence of a mobile-phone number, define a claims-based authorization policy instead. RBAC is the simpler choice when roles alone express the needed permissions; more advanced requirements can use policy-based authorization. section 9.4.7 section 9.6
