CODEWITHSUNDEEP
c#asp.netasp.net-authentication
yuvalm2
yuvalm2

Reputation: 984

ASP.NET: What is the purpose of IAuthorizationService

I am trying to understand the ASP.NET policy-based authorization mechanism, and I understand that I need to do the following:

  1. Set up a policy
  2. Assign requirements to that policy
  3. Define authorization handlers to these requirements which perform the actual validation (And return whether the requirements were fulfilled or not)
  4. Add the authorization handlers to the dependency injection mechanism

However, reading the ASP.NET documentation, I understand I might need to set up an IAuthorizationService as well. I failed to understand why that is needed from the ASP.NET documentation.

Do I have to set one up? What should it do? Is that an alternative to the policy and authorization handlers I am setting up or a required addition to them?

Upvotes: 3

Views: 1872

Answers (1)

shirados
shirados

Reputation: 56

You can override IAuthorizationService to take control of full authorization logic in your application. By default, IAuthorizationService is responsible for validation of Policy- Claim- or Role-based ruled, defined in AuthorizationOptions.

IAuthorizationService is usually being invoked in IAsyncAuthorizationFilter (which MVC adds automatically once you mark Controller or Action with [Authorize] attribute).

Upvotes: 3

Related Questions