title: Override global authorize filter in ASP.NET Core 1.0 MVC
body: <p>I am trying to set up authorization in ASP.NET Core 1.0 (MVC 6) web app.</p>
  
  <p>More restrictive approach - by default I want to restrict all controllers and action methods to users with <code>Admin</code> role. So, I am adding a global authorize attribute like:</p>
  
  <pre class="lang-cs prettyprint-override"><code>AuthorizationPolicy requireAdminRole = new AuthorizationPolicyBuilder()
      .RequireAuthenticatedUser()
      .RequireRole("Admin")
      .Build();
  services.AddMvc(options =&gt; { options.Filters.Add(new AuthorizeFilter(requireAdminRole));});
  </code></pre>
  
  <p>Then I want to allow users with specific roles to access concrete controllers. For example:</p>
  
  <pre class="lang-cs prettyprint-override"><code>[Authorize(Roles="Admin,UserManager")]
  public class UserControler : Controller{}
  </code></pre>
  
  <p>Which of course will not work, as the "global filter" will not allow the <code>UserManager</code> to access the controller as they are not "admins".</p>
  
  <p>In MVC5, I was able to implement this by creating a custom authorize attribute and putting my logic there. Then using this custom attribute as a global. For example:</p>
  
  <pre class="lang-cs prettyprint-override"><code>public class IsAdminOrAuthorizeAttribute : AuthorizeAttribute
  {
      public override void OnAuthorization(AuthorizationContext filterContext)
      {
          ActionDescriptor action = filterContext.ActionDescriptor;
          if (action.IsDefined(typeof(AuthorizeAttribute), true) ||
              action.ControllerDescriptor.IsDefined(typeof(AuthorizeAttribute), true))
          {
              return;
          }
  
          base.OnAuthorization(filterContext);
      }
  }
  </code></pre>
  
  <p>I tried to create a custom <code>AuthorizeFilter</code>, but no success. API seems to be different.</p>
  
  <p>So my question is: Is it possible to set up default policy and then override it for specific controllers and actions. Or something similar.
  I don't want to go with this </p>
  
  <pre class="lang-cs prettyprint-override"><code>[Authorize(Roles="Admin,[OtherRoles]")]
  </code></pre>
  
  <p>on every controller/action, as this is a potential security problem. What will happen if I accidentally forget to put the <code>Admin</code> role.</p>