ASP.NET Core Custom Authorization Attribute to inspect both Claims & Specific RouteValue

Viewed 285

I have a .NET Core Web API and am using IdentityServer4.

I need to implement an Authorization Attribute which will check:

  1. Does the user have a Claim of type 'DealerId'.

  2. If so, does the value of this Claim == [specific parameter value sent to the Api]

In an ideal world, I'd like to be able to do something like the following, however, I'm aware that in order to set that property within the attribute, it needs to be a constant value, and I can't simply specify the param from the requested method:

[ClaimRequirementAuthorization( DealerId = id)]
public IEnumerable<string> GetDealer(int id){
...
}

It also appears that some of the Authorization attribute stuff has changed in .NET Core, so am unsure of the most suitable approach to accomplish this.

0 Answers
Related