title: .NET Core 3.0 ClaimsTransformation
body: <p>Previously in .NET Framework I used a custom <code>RoleProvider</code> alongside Windows Authentication to deliver custom roles against the current principal as opposed to using Active Directory groups.</p>
  
  <p>So, the goal is to be able to use the decorative <code>[Authorize(Roles="")]</code> attribute where the roles are coming from a database and not active directory (or a combination of both would be fine). </p>
  
  <p>To achieve this in core I believe I need to use <code>IClaimsTransformation</code> to assign role claims as discussed <a href="https://stackoverflow.com/questions/51873269/asp-net-core-2-1-custom-roleprovider-with-windows-authentication#answer-53549574">here</a>. </p>
  
  <p>Here I'm just trying to add one role "Admin" however when I use <code>[Authorize(Roles = "Admin")]</code> I get a 403 Unauthorised response. </p>
  
  <p>Startup.cs</p>
  
  <pre><code>services.AddRazorPages();
  services.AddAuthentication(IISDefaults.AuthenticationScheme);
  services.AddSingleton&lt;IClaimsTransformation, ClaimsTransformer&gt;();
  -------
  app.UseAuthorization();
  </code></pre>
  
  <p>ClaimsTransformer.cs</p>
  
  <pre><code>    public class ClaimsTransformer : IClaimsTransformation
      {
          public async Task&lt;ClaimsPrincipal&gt; TransformAsync(ClaimsPrincipal principal)
          {
              var identity = (ClaimsIdentity)principal.Identity;
              var c = new Claim(identity.RoleClaimType, "Admin");
              identity.AddClaim(c);
              return await Task.FromResult(principal);
          }
      }
  </code></pre>
  
  <p>Annoyingly this works when I call <code>User.IsInRole()</code> and I can see the group when I inspect the Claims so it is being added however it doesn't work with the Authorize attribute. Any advice would be appreciated.</p>