Create a policy that don't check a claim for Admin role

Question

I want to build permission based authorization in ASP.NET Core 3.1. I implemented policies in my Startup.cs but also I don't want to use custom requirements handler for all policies. Because my condition is simple. For example if the user has role Admin don't check and authorize, if user has User role then check relational claim at the Startup.cs for a policy.

I implemented at Startup.cs like this:

services.AddAuthorization(options =>
{
    options.AddPolicy("GetDefinition",
        policy => policy.RequireRole("Admin", "User")
                        .RequireClaim("CanGetDefinition"));
});

How can I skip checking a claim if the user has Admin role in a policy creation?

Answer 1

Maybe something based on using-a-func-to-fulfill-a-policy:

services.AddAuthorization(options =>
{
    options.AddPolicy("GetDefinition",
        policy => policy.RequireAssertion(
             (context) => {
                 return context.User.IsInRole("Admin") || 
                        (
                             context.User.IsInRole("User") && 
                             context.User.HasClaim(p => p.Type == "CanGetDefinition")
                        );
             }
});