title: What's the technical advantage of claim/role/policy authorization as opposed to plain check of a user's ID?
body: <p>I used Identity Server and protected endpoints with policies and roles. Those are reflected in the access token I'm distributing to the client. Today, I got the suggestion that instead of protecting a method like this:</p>
  <pre><code>[Authorize(Policy = &quot;Elevated&quot;), HttpGet(&quot;metadata&quot;)]
  public IActionResult GetTenantMetadata() { ... }
  </code></pre>
  <p>we could skip the <code>role</code> section of the JWT and only do the following.</p>
  <pre><code>[Authorize, HttpGet(&quot;metadata&quot;)]
  public IActionResult GetTenantMetadata() { ... }
  </code></pre>
  <p>Then, in the <em>Startup.cs</em>, we'd register a custom handler like this.</p>
  <pre><code>services.AddHttpContextAccessor();
  services.AddTransient&lt;IAuthorizationHandler, HeaderHandler&gt;();
  </code></pre>
  <p>The actual security would be then performed in the handler based on the <code>sub</code> value from the token. No roles, no scopes no nothing. To me, it appears intuitively ill-advised putting a lot of responsibility on me to create the protective logic, instead of relying on IDS and people way smarter than me. All the solutions I've seen deal with security using claims and roles. So my gut feeling says it's a bad idea.</p>
  <pre><code>protected override Task HandleRequirementAsync(
          AuthorizationHandlerContext context,
          CustomRequirement requirement)
      {
          HttpRequest request = Accessor.HttpContext.Request;
          string param = request.Headers.SingleOrDefault(a =&gt; a.Key == &quot;param1&quot;);
          string someAccess = dbContext.GetAccess(param, context.User.GetUserId());
  
          bool authorized = SomeEvaluation(param, someAccess);
          if (authorized) context.Succeed(requirement);
          else context.Fail();
  
          return Task.CompletedTask;
      }
  </code></pre>
  <p>However, I wasn't able to motivate my choice (other than the guts and others' samples), so finally, I got unsure. I'm humble to understand that if I can't explain why, then maybe I'm wrong.</p>
  <p>I googled <em>claims based security</em> and <em>roles policies security</em> etc. but I could come up with a name for the suggested alternative. Consequently, I haven't found any material discussing that matter.</p>
  <p>What is such a custom authorization method called and what's the advantage/caveat of it?</p>