Authorize an action to Admin and only the user who created and event in dotnet core

17 Views Asked by At

I need to authorize the edit action method for admin or only the users who created it.

I am adding these policy

services.AddAuthorization(options =>
{
    options.AddPolicy("EditAnyEventPolicy", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.RequireRole("Admin");
    });
    options.AddPolicy("EditEventPolicy", policy =>
    {
        policy.RequireAuthenticatedUser();
        policy.RequireClaim("event_creator");
    });
});
[Authorize(Policy = "EditAnyEventPolicy")]
[Authorize(Policy = "EditEventPolicy")]
public IActionResult EditEvent()
{
    //code
}

The problem is that now users who have admin role and created the event can edit. I need an OR functionality.

How to achieve this?

0

There are 0 best solutions below