Require authenticated user in asp.net core but require custom policy in some actions require custom policy
<p>My Asp.net core site required authentication by default</p>

<pre><code>services.AddMvc(config =&gt;
{
    //only allow authenticated users
    var policy = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .Build();

    config.Filters.Add(new AuthorizeFilter(policy));
});
</code></pre>

<p>but for one action I would need to allow anonymous access (/Account/AddUser if there are no users in the database).</p>

<p>I created this custom policy which checks that the user is either authenticated or that the user db is empty.</p>

<pre><code>[Authorize(Policy = "NoUsersInDatabaseOrUserAuthenticated")]
public IActionResult AddUser()
{
    return View();
}
</code></pre>

<p>There seems to be an AND between the global policy and this so it won't work. If I add [AllowAnonymous] the policy is not evaluated at all.</p>

<p>How can I replace the global policy with a custom policy for one action?</p>