authorization policies

Required scopes

You have several ways of specifying that scopes are required to call a web API:

• using the RequiredScopes on a controller, or a controller action
• defining authentication policies at the level of your application, and enforcing them for the app, or on any [Authorize] attribute (using the Policy= property of that attribute)

Required scopes attribute

The RequiredScopes have two exclusive parameters:

• scopes
• configuration entry pointing to scopes

[RequiredScopes("access_as_user")}
public class Controller : ApiController
{
}

Authentication policies

  services.AddAuthorization(options =>
  {
   options.AddPolicy(policy, policyBuilder => {
     policyBuilder.Requirements.Add(new ScopeAuthorizationRequirement() { RequiredScopesConfigurationKey = $"{ConfigSectionName}:Scope" });
    });
  });

  services.AddAuthorization(options =>
  {
   options.AddPolicy(policy, policyBuilder => {
     policyBuilder.RequireScope(scopes?.Split(' '));
    });
  });