I need to authorize the edit action method for admin or only the users who created it.
I am adding these policy
services.AddAuthorization(options =>
{
options.AddPolicy("EditAnyEventPolicy", policy =>
{
policy.RequireAuthenticatedUser();
policy.RequireRole("Admin");
});
options.AddPolicy("EditEventPolicy", policy =>
{
policy.RequireAuthenticatedUser();
policy.RequireClaim("event_creator");
});
});
[Authorize(Policy = "EditAnyEventPolicy")]
[Authorize(Policy = "EditEventPolicy")]
public IActionResult EditEvent()
{
//code
}
The problem is that now users who have admin role and created the event can edit. I need an OR functionality.
How to achieve this?