Custom authorization

In the previous section, we learned how to use policy-based authorization and implement custom logic to handle authorization requirements. But it is not always possible to register authorization policies in Startup.cs like that. In this section, we shall see how to use IAuthorizationPolicyProvider to dynamically build policy configurations in your application.

The IAuthorizationPolicyProvider interface has three methods to be implemented:

• GetDefaultPolicyAsync: This method returns the default authorization policy to be used.
• GetFallbackPolicyAsync: This method returns the fallback authorization policy. It is used when no explicit authorization requirement is defined.
• GetPolicyAsync: This method is used to build and return an authorization policy for the provided policy name.

Let's look into an example where you want to authorize a request to several controllers/actions based on different age criteria, say Over14, Over18, Over21,...