Policy-based authorization
Policy-based authorization allows you to write your own logic to handle authorization requirements that suit your needs. For example, you have a requirement to verify a user's age and authorize the placing of an order only if the user is above 14 years of age. You can use the policy-based authorization model to handle this requirement.
To configure policy-based authorization, we need to define a requirement and a handler, and then register the policy with the requirement. Let's understand these components:
- A policy is defined with one or more requirements.
- A requirement is a collection of data parameters used by the policy to evaluate the user's identity.
- A handler is responsible for evaluating data from the requirement against the context and determining whether access can be granted or not.
In the following section, we shall see how to create a requirement and a handler, and register an authorization policy.