Scenario:
- I have an API with .net core 2.2
- On top my controller I authorize access using IdentityServer4 with an Attribute
- Inside one of my endpoints I want to authorize access to a method only in some cases
I implemented resource based authorization inside my endpoint just like it's shown in microsoft documentation. It didn't work. I put a breakpoint inside my authorization handler and tried debugging, but when this handler should be called, it is not. I mean that when the following line runs
var authorizationResult = await _authorizationService
.AuthorizeAsync(User, Document, "EditPolicy");
the Handler should be called, but that never happens.
Did anyone have the same problem?
So in the end the problem was due to the registration of the service in the startup.cs. I was using TryAddScope, by changing to AddScope it worked fine.