{"action":"opened","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/500","labels_url":"https://api.github.com/repos/aspnet/Security/issues/500/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/500/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/500/events","html_url":"https://github.com/aspnet/Security/issues/500","id":108887488,"number":500,"title":"AuthorizationOptions.DefaultPolicy","user":{"login":"XplMarcel","id":14347467,"avatar_url":"https://avatars.githubusercontent.com/u/14347467?v=3","gravatar_id":"","url":"https://api.github.com/users/XplMarcel","html_url":"https://github.com/XplMarcel","followers_url":"https://api.github.com/users/XplMarcel/followers","following_url":"https://api.github.com/users/XplMarcel/following{/other_user}","gists_url":"https://api.github.com/users/XplMarcel/gists{/gist_id}","starred_url":"https://api.github.com/users/XplMarcel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/XplMarcel/subscriptions","organizations_url":"https://api.github.com/users/XplMarcel/orgs","repos_url":"https://api.github.com/users/XplMarcel/repos","events_url":"https://api.github.com/users/XplMarcel/events{/privacy}","received_events_url":"https://api.github.com/users/XplMarcel/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-09-29T14:54:29Z","updated_at":"2015-09-29T14:54:29Z","closed_at":null,"body":"I'm trying to replace the DefaultPolicy with my own Policy like this:\r\n\r\nservices.AddMvcCore()\r\n        .AddAuthorization(options => {\r\n           options.DefaultPolicy = new AuthorizationPolicyBuilder(OAuthBearerAuthenticationDefaults.AuthenticationScheme).RequireAuthenticatedUser()\r\n          .AddRequirements(new TenantRequirement()).Build();\r\n        })\r\n        .AddFormatterMappings()\r\n        .AddJsonFormatters()\r\n        .AddViews();\r\n\r\nTo my opinion the Authorize attribute should only use the requirements from that policy. (Correct me if i'm wrong). The TenantRequirement is used to make sure the a user has a claim for a route which uses a TenantId.\r\n\r\nIf i change the Authorize attribute to [Authorize(Roles = \"Administrator\")] it looks like the RolesAuthorizationRequirement is used (i get a 403 - Forbidden), which is strange considering the DefaultPolicy shouldn't have that requirement.\r\n\r\nIf i make sure the user has that specific role however, the TenantRequirement doesn't execute at all.\r\n\r\nAny ideas ?"}}