title: best practice: customize asp.net core identity authorization
body: <p>I am fairly new with asp.net identity server.  I know how to customize the IdentityUser entity and scaffold / override Identity UI.  I'm looking for a high level how-to, best practice on authorization given these circumstances:</p>
  
  <p>A component within the application needs to consider these items for authorization:</p>
  
  <ul>
  <li>roles</li>
  <li>location</li>
  <li>division</li>
  <li>entity (the specific component within the application.  Like "Manage News")</li>
  </ul>
  
  <p>Coming from a class web forms background, I tend to think like so to define roles:</p>
  
  <pre><code>public int assignId; //key
  public int userId;
  public int roleId;
  public int? locationId;
  public int? divisionId;
  public int? entityId;
  </code></pre>
  
  <h2>Real World Scenarios</h2>
  
  <ul>
  <li>User "Adam" with Role "Global Admin" has rights to everything.</li>
  <li>User "Joe" with Role "Admin" and Location "Indy" has rights to every Entity in the "Indy" location.</li>
  <li>User "Blow" with Role "Admin" and Location "Indy" and Division "IT" has rights to every "IT" entity in "Indy"</li>
  <li>User "Joe" with Role "Admin" and Location "Chicago" and Division "Safety" and Entity "News" could post news for Safety division in Chicago only. (In addition to the rule above regarding Joe and Indy) </li>
  </ul>
  
  <h3>So, my question?</h3>
  
  <p>What would be the best way to handle these sort of authorization rules / policies using asp.net core 2.1 identity?  Adding claims like "loc"/"indy"?  </p>
  
  <p>Would I setup custom authorization handlers to check claims?  Or would I set up a middleware table to handle the associations like I would back in the traditional webforms days? Or is there a best practice for this scenario??</p>
  
  <p><i>Thank you for your help!!!!!!!</i></p>