{"action":"created","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/500","labels_url":"https://api.github.com/repos/aspnet/Security/issues/500/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/500/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/500/events","html_url":"https://github.com/aspnet/Security/issues/500","id":108887488,"number":500,"title":"AuthorizationOptions.DefaultPolicy","user":{"login":"XplMarcel","id":14347467,"avatar_url":"https://avatars.githubusercontent.com/u/14347467?v=3","gravatar_id":"","url":"https://api.github.com/users/XplMarcel","html_url":"https://github.com/XplMarcel","followers_url":"https://api.github.com/users/XplMarcel/followers","following_url":"https://api.github.com/users/XplMarcel/following{/other_user}","gists_url":"https://api.github.com/users/XplMarcel/gists{/gist_id}","starred_url":"https://api.github.com/users/XplMarcel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/XplMarcel/subscriptions","organizations_url":"https://api.github.com/users/XplMarcel/orgs","repos_url":"https://api.github.com/users/XplMarcel/repos","events_url":"https://api.github.com/users/XplMarcel/events{/privacy}","received_events_url":"https://api.github.com/users/XplMarcel/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/aspnet/Security/labels/bug","name":"bug","color":"fc2929"}],"state":"open","locked":false,"assignee":{"login":"HaoK","id":6537861,"avatar_url":"https://avatars.githubusercontent.com/u/6537861?v=3","gravatar_id":"","url":"https://api.github.com/users/HaoK","html_url":"https://github.com/HaoK","followers_url":"https://api.github.com/users/HaoK/followers","following_url":"https://api.github.com/users/HaoK/following{/other_user}","gists_url":"https://api.github.com/users/HaoK/gists{/gist_id}","starred_url":"https://api.github.com/users/HaoK/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/HaoK/subscriptions","organizations_url":"https://api.github.com/users/HaoK/orgs","repos_url":"https://api.github.com/users/HaoK/repos","events_url":"https://api.github.com/users/HaoK/events{/privacy}","received_events_url":"https://api.github.com/users/HaoK/received_events","type":"User","site_admin":false},"milestone":{"url":"https://api.github.com/repos/aspnet/Security/milestones/13","html_url":"https://github.com/aspnet/Security/milestones/1.0.0-rc1","labels_url":"https://api.github.com/repos/aspnet/Security/milestones/13/labels","id":1311568,"number":13,"title":"1.0.0-rc1","description":null,"creator":{"login":"Eilon","id":202643,"avatar_url":"https://avatars.githubusercontent.com/u/202643?v=3","gravatar_id":"","url":"https://api.github.com/users/Eilon","html_url":"https://github.com/Eilon","followers_url":"https://api.github.com/users/Eilon/followers","following_url":"https://api.github.com/users/Eilon/following{/other_user}","gists_url":"https://api.github.com/users/Eilon/gists{/gist_id}","starred_url":"https://api.github.com/users/Eilon/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Eilon/subscriptions","organizations_url":"https://api.github.com/users/Eilon/orgs","repos_url":"https://api.github.com/users/Eilon/repos","events_url":"https://api.github.com/users/Eilon/events{/privacy}","received_events_url":"https://api.github.com/users/Eilon/received_events","type":"User","site_admin":false},"open_issues":36,"closed_issues":5,"state":"open","created_at":"2015-09-17T22:03:39Z","updated_at":"2015-10-01T22:38:02Z","due_on":null,"closed_at":null},"comments":14,"created_at":"2015-09-29T14:54:29Z","updated_at":"2015-10-02T23:57:33Z","closed_at":null,"body":"I'm trying to replace the DefaultPolicy with my own Policy like this:\r\n\r\n```\r\nservices.AddMvcCore()\r\n        .AddAuthorization(options => {\r\n           options.DefaultPolicy = new AuthorizationPolicyBuilder(OAuthBearerAuthenticationDefaults.AuthenticationScheme).RequireAuthenticatedUser()\r\n          .AddRequirements(new TenantRequirement()).Build();\r\n        })\r\n        .AddFormatterMappings()\r\n        .AddJsonFormatters()\r\n        .AddViews();\r\n```\r\n\r\nTo my opinion the Authorize attribute should only use the requirements from that policy. (Correct me if i'm wrong). The TenantRequirement is used to make sure the a user has a claim for a route which uses a TenantId.\r\n\r\nIf i change the Authorize attribute to [Authorize(Roles = \"Administrator\")] it looks like the RolesAuthorizationRequirement is used (i get a 403 - Forbidden), which is strange considering the DefaultPolicy shouldn't have that requirement.\r\n\r\nIf i make sure the user has that specific role however, the TenantRequirement doesn't execute at all.\r\n\r\nAny ideas ?"},"comment":{"url":"https://api.github.com/repos/aspnet/Security/issues/comments/145185405","html_url":"https://github.com/aspnet/Security/issues/500#issuecomment-145185405","issue_url":"https://api.github.com/repos/aspnet/Security/issues/500","id":145185405,"user":{"login":"blowdart","id":796298,"avatar_url":"https://avatars.githubusercontent.com/u/796298?v=3","gravatar_id":"","url":"https://api.github.com/users/blowdart","html_url":"https://github.com/blowdart","followers_url":"https://api.github.com/users/blowdart/followers","following_url":"https://api.github.com/users/blowdart/following{/other_user}","gists_url":"https://api.github.com/users/blowdart/gists{/gist_id}","starred_url":"https://api.github.com/users/blowdart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/blowdart/subscriptions","organizations_url":"https://api.github.com/users/blowdart/orgs","repos_url":"https://api.github.com/users/blowdart/repos","events_url":"https://api.github.com/users/blowdart/events{/privacy}","received_events_url":"https://api.github.com/users/blowdart/received_events","type":"User","site_admin":false},"created_at":"2015-10-02T23:57:33Z","updated_at":"2015-10-02T23:57:33Z","body":"Interesting.\r\n\r\nIf you override the default policy would users expect to be applied everywhere, as it's the default? Even where there's no authorize attribute?\r\n\r\nI wonder if by exposing the request in policy you could do the tenant check (assuming the tenant is in the path)"}}