title: Can I use the Authorize attribute filtering by Roles and Claims when using ASP.NET Identity and JWT authentication from external providers?
body: <p>So I’m using firebase for authentication on my WebAPI app. It gets a JWT token and then authenticates it and then puts the claims in the <code>HttpContext.User</code>.</p>
  
  <p>My only problem is I just want to use Firebase Authentication for authentication, not for authorization. I want to use ASP.NET Identity for this.</p>
  
  <p>so right now, when someone connects to my server, I’ll check if they don’t have an account, if not I will create one for them.</p>
  
  <pre><code>var name = _contextAccessor.HttpContext.User.Claims.First(c =&gt; c.Type == "user_id").Value;
  
  ApplicationUser user = await _userManager.FindByNameAsync(name);
  
  if (user == null)
  {
      user = new ApplicationUser(name);
      await _userManager.CreateAsync(user);                
  }
  </code></pre>
  
  <p>So this works, and now there is a record in the ASPNetUsers against the user and later on, I can give it Claims and Roles against whatever business rules I’d like.</p>
  
  <p>However, my question is, previously, when I’ve used ASP.NET Identity I’ve been able to leverage all of the built-in features like the Authorize attribute to do my authorization.</p>
  
  <p>So if both authentication and authorization is done using ASP.NET Identity, I can write</p>
  
  <pre><code>[Authorize(Roles = "Administrator")]
  </code></pre>
  
  <p>Obviously, that won’t work with external authentication because <code>HttpContext.User</code> is the Firebase Authenticated user, not the corresponding ASP.NET Identity user that has the Administrator role.</p>
  
  <p>Is there a way to customize the existing Authorize attribute to configure it to somehow convert my firebase token into an ASP.NET Identity so that it would recognize the roles and claims it has or if I wanted to do all this through middleware, am I going to need to write my own authorize attribute?</p>