How to add custom authorization in .NET 5?

Question

I have ASP.NET Core MVC application using NET 5. Only authenticated users are allowed to access the application. The authorization policy below takes care of it.

    public void ConfigureServices(IServiceCollection services)
    {
        services.AddControllersWithViews(options =>
        {
            var authorizationPolicy = new AuthorizationPolicyBuilder()
                   .RequireClaim(ClaimTypes.Email)
                   .RequireClaim(ClaimTypes.NameIdentifier)
                   .RequireClaim(ClaimTypes.Name)
                   .RequireClaim(IdentityClaimTypes.IdToken)
                   .RequireAuthenticatedUser()
                   .Build();
            options.Filters.Add(new AuthorizeFilter(authorizationPolicy));
        }) 
     }

The controllers are also using AuthorizeRoles attribute to check access based on roles.

public class AuthorizeRolesAttribute : AuthorizeAttribute
{
    public AuthorizeRolesAttribute(params string[] roles) : base()
    {
        if (roles.Length > 0)
        {
            Roles = string.Join(",", roles);
        }
    }
}


[AuthorizeRoles("ClientAdmin")]
public class WorkItemClientsController : BaseController
{
    private readonly IClientWorkItemService _clientWorkItemService;

    public WorkItemClientsController(IClientWorkItemService clientWorkItemService)
    {
        _clientWorkItemService = clientWorkItemService;
    }

    [HttpGet]
    [Route("workitems/{workItemID}/clients")]
    public async Task<ActionResult> Index([FromRoute(Name = "workItemID")] int workItemID)
    {
        
    }
 }

The application has few actions that need to be further authorized based on the user's data in the database. I have the following

public class WorkItemRequirement : IAuthorizationRequirement
{
}

public class WorkItemAuthorizationHandler : AuthorizationHandler<WorkItemRequirement>
{
  protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, WorkItemRequirement requirement)
    {
       //check if logged in user can access this route based on workitemid from the route, if true then return context.Succeed(requirement);
    }
}

public class WorkItemAuthorizeAttribute : AuthorizeAttribute
{       
  public WorkItemAuthorizeAttribute()
  { 
    Policy = "WorkItemPolicy"
  }
}

I will add WorkItemAuthorizeAttribute to require action methods.

What I am missing here is how WorkItemAuthorizeAttribute will know which handler to invoke. In this case its WorkItemAuthorizationHandler.
What do I need to change/add in AuthorizationPolicyBuilder in startup.cs to make this association?

Answer 1

Pretty much everything you can find in official docs here basically as you said you need to modify your policy to include your WorkItemRequirement like that:

.Requirements.Add(new WorkItemRequirement());

That will 'glue' Policy in your Attribute with your AuthorizationHandler