title: ASP.NET Core Authorization: Combining OR requirements
body: <p>I'm not sure how to implement combined "OR" requirements in ASP.NET Core Authorization. In previous versions of ASP.NET this would have been done with roles, but I'm trying to do this with claims, partly to understand it better. </p>
  
  <p>Users have an enum called AccountType that will provide different levels of access to controllers/actions/etc. There are three levels of types, call them User, BiggerUser, and BiggestUser. So BiggestUser has access to everything the account types below them have and so on. I want to implement this via the Authorize tag using Policies.</p>
  
  <p>So first I have a requirement:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class TypeRequirement : IAuthorizationRequirement
  {
      public TypeRequirement(AccountTypes account)
      {
          Account = account;
      }
  
      public AccountTypes Account { get; }
  }
  </code></pre>
  
  <p>I create the policy:</p>
  
  <pre class="lang-cs prettyprint-override"><code>services.AddAuthorization(options =&gt;
  {
      options.AddPolicy("UserRights", policy =&gt; 
          policy.AddRequirements(new TypeRequirement(AccountTypes.User));
  });
  </code></pre>
  
  <p>The generalized handler:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class TypeHandler : AuthorizationHandler&lt;TypeRequirement&gt;
  {
      protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TypeRequirement requirement)
      {
          if (!context.User.HasClaim(c =&gt; c.Type == "AccountTypes"))
          { 
              context.Fail();
          }
  
          string claimValue = context.User.FindFirst(c =&gt; c.Type == "AccountTypes").Value;
          AccountTypes claimAsType = (AccountTypes)Enum.Parse(typeof(AccountTypes), claimValue);
          if (claimAsType == requirement.Account)
          {
              context.Succeed(requirement);
          }
  
          return Task.CompletedTask;
      }
  }
  </code></pre>
  
  <p>What I would to do is add multiple requirements to the policy whereby <em>any</em> of them could satisfy it. But my current understanding is if I do something like:</p>
  
  <pre class="lang-cs prettyprint-override"><code>options.AddPolicy("UserRights", policy =&gt; policy.AddRequirements(
      new TypeRequirement(AccountTypes.User),
      new TypeRequirement(AccountTypes.BiggerUser)
  );
  </code></pre>
  
  <p><em>Both</em> requirements would have to be satisfied. My handler would work if there was someway in AddRequirements to specify an OR condition. So am I on the right track or is there a different way to implement this that makes more sense?</p>