Override global authorize filter in ASP.NET Core 1.0 MVC
<p>I am trying to set up authorization in ASP.NET Core 1.0 (MVC 6) web app.</p>

<p>More restrictive approach - by default I want to restrict all controllers and action methods to users with <code>Admin</code> role. So, I am adding a global authorize attribute like:</p>

<pre class="lang-cs prettyprint-override"><code>AuthorizationPolicy requireAdminRole = new AuthorizationPolicyBuilder()
    .RequireAuthenticatedUser()
    .RequireRole("Admin")
    .Build();
services.AddMvc(options =&gt; { options.Filters.Add(new AuthorizeFilter(requireAdminRole));});
</code></pre>

<p>Then I want to allow users with specific roles to access concrete controllers. For example:</p>

<pre class="lang-cs prettyprint-override"><code>[Authorize(Roles="Admin,UserManager")]
public class UserControler : Controller{}
</code></pre>

<p>Which of course will not work, as the "global filter" will not allow the <code>UserManager</code> to access the controller as they are not "admins".</p>

<p>In MVC5, I was able to implement this by creating a custom authorize attribute and putting my logic there. Then using this custom attribute as a global. For example:</p>

<pre class="lang-cs prettyprint-override"><code>public class IsAdminOrAuthorizeAttribute : AuthorizeAttribute
{
    public override void OnAuthorization(AuthorizationContext filterContext)
    {
        ActionDescriptor action = filterContext.ActionDescriptor;
        if (action.IsDefined(typeof(AuthorizeAttribute), true) ||
            action.ControllerDescriptor.IsDefined(typeof(AuthorizeAttribute), true))
        {
            return;
        }

        base.OnAuthorization(filterContext);
    }
}
</code></pre>

<p>I tried to create a custom <code>AuthorizeFilter</code>, but no success. API seems to be different.</p>

<p>So my question is: Is it possible to set up default policy and then override it for specific controllers and actions. Or something similar.
I don't want to go with this </p>

<pre class="lang-cs prettyprint-override"><code>[Authorize(Roles="Admin,[OtherRoles]")]
</code></pre>

<p>on every controller/action, as this is a potential security problem. What will happen if I accidentally forget to put the <code>Admin</code> role.</p>