C# Academy · Lesson

Claims-Based Authorization

Authorize based on user claims.

Claims-Based Authorization is a free C# Academy lesson on CoddyKit — lesson 2 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the C# Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

Beyond Roles

Roles are a special case of claims. Claims-based authorization checks any claim - email, department, subscription tier, a permission flag - not just roles.

This gives you finer control without inventing dozens of roles.

// Claims a user might carry:
// department = sales
// subscription = pro
// email_verified = true

Adding Claims to a Token

Issue whatever claims your authorization rules will inspect. The claim is a type/value pair.

var claims = new List<Claim>
{
    new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
    new Claim("department", "sales"),
    new Claim("subscription", "pro"),
    new Claim("email_verified", "true")
};

Defining a Claims Policy

Claims-based rules are expressed as named policies registered with AddAuthorization. RequireClaim demands the user has a given claim.

builder.Services.AddAuthorization(options =>
{
    options.AddPolicy("VerifiedEmail", policy =>
        policy.RequireClaim("email_verified", "true"));
});

RequireClaim With No Value

If you only care that the claim exists (any value), call RequireClaim with just the type.

options.AddPolicy("HasDepartment", policy =>
    policy.RequireClaim("department"));

RequireClaim With Allowed Values

You can list allowed values; the policy passes if the claim matches any of them.

options.AddPolicy("PaidTier", policy =>
    policy.RequireClaim("subscription", "pro", "enterprise"));

Applying a Claims Policy

Reference the policy by name in [Authorize].

[Authorize(Policy = "PaidTier")]
[HttpGet("premium-reports")]
public IActionResult Reports() => Ok();

Minimal API Usage

Minimal APIs reference the same policy name through RequireAuthorization.

app.MapGet("/premium-reports", () => Results.Ok())
   .RequireAuthorization("PaidTier");

Combining Several Claim Requirements

A policy can chain multiple RequireClaim calls; all must be satisfied (AND).

options.AddPolicy("VerifiedSales", policy =>
    policy
        .RequireClaim("email_verified", "true")
        .RequireClaim("department", "sales"));

RequireAssertion for Custom Logic

When a fixed value check is not enough, RequireAssertion runs an arbitrary predicate over the ClaimsPrincipal.

options.AddPolicy("AdultUser", policy =>
    policy.RequireAssertion(ctx =>
    {
        var dob = ctx.User.FindFirst("birthdate")?.Value;
        return DateTime.TryParse(dob, out var d) &&
               d <= DateTime.UtcNow.AddYears(-18);
    }));

Reading Claims at Runtime

Inside an action you can still inspect claims directly when you need the value, not just a yes/no gate.

var dept = User.FindFirst("department")?.Value;
var isPro = User.HasClaim("subscription", "pro");

Claims vs Roles - When to Use Which

Use roles for broad job functions. Use claims for attributes and feature flags. They compose - a policy can require a role and several claims together.

options.AddPolicy("SalesManager", policy =>
    policy.RequireRole("manager")
          .RequireClaim("department", "sales"));

Quick Check

Confirm your understanding of claims policies.

Recap

You learned claims-based authorization:

Any claim - not just roles - can gate access.
RequireClaim checks existence or specific allowed values.
RequireAssertion handles custom predicate logic.
Claims and roles compose inside a single named policy.

Next: the full policy-based model.

Frequently asked questions

Is the “Claims-Based Authorization” lesson free?

Yes — the full text of “Claims-Based Authorization” is free to read here on the web, and the C# Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the C# Academy course, upgrade to CoddyKit PRO.

What will I learn in “Claims-Based Authorization”?

Authorize based on user claims. You practise C# Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start C# Academy?

No prior experience is required. C# Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 2 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “Claims-Based Authorization” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this C# Academy lesson?

Yes. Every C# Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

← Back to C# Academy