Requirement-Based Access Control

In this lesson, you will learn how to shift from simple role-based security to granular, requirement-based access control by evaluating complex user attributes.

Moving Beyond Roles

While Role-Based Access Control (RBAC) is great for broad categories (like "Admin" or "User"), it often falls short when access depends on specific metadata. For example, a "Manager" might only be allowed to approve an expense report if the report's value is under $5,000, or if they have completed a specific security training. This is where Requirement-Based Access Control shines: it allows you to define complex logic that inspects the user’s claims alongside the context of the requested operation.

Implementing Requirements

To implement this, you decouple the requirement from the handler. First, you define a class that implements IAuthorizationRequirement, which acts as a data container for your business logic parameters.

public class MinimumExperienceRequirement : IAuthorizationRequirement
{
    public int YearsRequired { get; }
    public MinimumExperienceRequirement(int years) => YearsRequired = years;
}

Next, you create a handler that evaluates the user's attributes (their claims) against this requirement:

public class ExperienceHandler : AuthorizationHandler<MinimumExperienceRequirement>
{
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, MinimumExperienceRequirement requirement)
    {
        var experienceClaim = context.User.FindFirst(c => c.Type == "YearsOfExperience")?.Value;
        
        if (int.TryParse(experienceClaim, out var years) && years >= requirement.YearsRequired)
        {
            context.Succeed(requirement);
        }
        
        return Task.CompletedTask;
    }
}

By registering this requirement in your policy configuration, you can apply it to your endpoints. The system now evaluates the user's specific data—in this case, their "YearsOfExperience" claim—rather than just checking a static role string. This creates a flexible security layer that can evolve as your application’s authorization needs become more sophisticated.

Key Takeaway: Requirement-based access control moves authorization logic away from static roles and toward dynamic, claim-aware evaluation that validates specific user attributes against business rules.