claims based identity - .Net core Authorize attribute in inherited controller -

i having trouble authorization policies. have basewebapicontroller action

[httpdelete("{id}"), authorize(policy = "administrator")] public virtual async task<iactionresult> delete(int id) {} 

but in controller inherits above want give access users also, policy like:

[httpdelete("{id}"), authorize(policy = "all")] public override task<iactionresult> delete(int id){} 

it seems regular users cannot access action. have search further errors in policy configuration, or since controller inherited,m it's attributes neglected?

thanks

the authorizeattribute attribute inherited , allows applied multiple times.

that means when inheriting method has authorizeattribute, carried over. final function definition in subclass this:

[authorize(policy = "administrator")] [authorize(policy = "all")] public override task<iactionresult> delete(int id) 

so route has 2 policies in place. kind of problem because policies designed cumulative. all policies have pass in order authentication succeed.

of course, not work because wanted “wash out” original policy base class. not possible though, have remove policy base class , maybe introduce second administrator-only class policies.

the general problem here policy design seems based on roles. using policies, effectively, checking on roles there. instead, should consider working requirements: example, delete something, user need fulfill “deletionallowed” requirement. allows more fine-grained policy system. , big benefit? requirement handlers disjunctive: 1 handler able fulfill requirement enough pass it.