asp.net核心中的授权类型

Question

I am confusing on use of which type of authorization in project: claim based or policy based authorization. is this dependent on the project's security design?or they are the same? according to microsoft doc we can config and use claims as follows:

private async Task CreateUserAndClaim(IServiceProvider serviceProvider) 
{
var claimList = (await UserManager.GetClaimsAsync(user)).Select(p => p.Type);  
if (!claimList.Contains("DateOfJoing")){  
    await UserManager.AddClaimAsync(user, new Claim("DateOfJoing", "09/25/1984"));  
}  
}

and then use of this claim as follows:

public void ConfigureServices(IServiceCollection services) 
{
 services.AddAuthorization(options =>  
{  
    options.AddPolicy("IsAdminClaimAccess", policy => policy.RequireClaim("DateOfJoing")); 
}

[Authorize(Policy = "IsAdminClaimAccess")]  
public IActionResult TestMethod1(){}

and config and use policy as follows:

public class MinimumTimeSpendRequirement: IAuthorizationRequirement  
{
public MinimumTimeSpendRequirement(int noOfDays)  
{  
    TimeSpendInDays = noOfDays;  
}  

protected int TimeSpendInDays { get; private set; }  
}

public class MinimumTimeSpendHandler : AuthorizationHandler<MinimumTimeSpendRequirement>
{
...
var dateOfJoining = Convert.ToDateTime(context.User.FindFirst(  
        c => c.Type == "DateOfJoining").Value);  
}

public void ConfigureServices(IServiceCollection services)  
{
services.AddAuthorization(options =>  
 {  
    ...  
    ...  
    options.AddPolicy("IsAdminPolicyAccess", policy => policy.Requirements.Add(new MinimumTimeSpendRequirement(365)));  
 } 
}

and then use of this policy same as claim in my controller. as you see,both do one thing.controll user join date.which is better?is attention for better speed and security? or it looks both are same?

Answer 1

Claims are something that define the user, it's a key - value pair.

Age : 30 | Sex : Male | Name : Bob Marley | Email : foo@kek.com

You get the picture. You can then implement an authorization check based on the claim and value.

Further

You can define a policy, policy is something you need to abide by in order to get access. It can consist of multiple claim checks.

So you can make a policy: IsMaleAndOver18, would require the user to have 2 claims: Age where the value is over 18 and where Sex is Male.

When implementing they may look similar in code but in reality they are very different.