title: ASP.NET Core Authorization Policies: Can't step into the handler?
body: <p>I have JWT-based claims authentication/ authorization set up in my .NET Core application, which authenticates as expected, but my policy enforcement is not acting as I would expect.</p>
  
  <p>I have a requirements implementation and handler set up as follows:</p>
  
  <pre><code>public class ImpersonationRequirement : IAuthorizationRequirement
  {
  }
  
  public class ImpersonationHandler : AuthorizationHandler&lt;ImpersonationRequirement&gt;
  {
      protected override Task HandleRequirementAsync(AuthorizationHandlerContext context,
          ImpersonationRequirement requirement)
      {
          if (context.User.CanImpersonate()) context.Succeed(requirement);
  
          return Task.CompletedTask;
      }
  }
  </code></pre>
  
  <p>I have a helper set up like so:</p>
  
  <pre><code>public static bool CanImpersonate(
      this ClaimsPrincipal principal)
  {
      var val = principal?.FindFirst(MyClaimTypes.CAN_IMPERSONATE)?.Value;
      return bool.TryParse(val, out var value) &amp;&amp; value;
  }
  
  public class MyClaimTypes
  {
      /// &lt;summary&gt;
      /// Boolean value indicating this user is authorized to impersonate other customer accounts.
      /// &lt;/summary&gt;
      public const string CAN_IMPERSONATE = "cim";
  
      ...
  
      /// &lt;summary&gt;
      /// Actual name of the user impersonating the current user.
      /// &lt;/summary&gt;
      public const string IMPERSONATING_USER = "imp";
  }
  </code></pre>
  
  <p>...off of my <code>Startup.cs</code>, I have the policy defined:</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
  {
      options.AddPolicy("Impersonator", policy =&gt; policy.Requirements.Add(new ImpersonationRequirement()));
  });
  </code></pre>
  
  <p>...and on my controller, it's written as such:</p>
  
  <pre><code>[Produces("application/json")]
  [Authorize(Policy = "Impersonator")]
  public class ImpersonationController : Controller
  {
      private readonly ILogger _logger;
      private readonly ITokenManagementService _tokenManagementService;
      private readonly UserManager&lt;MyUser&gt; _userManager;
  
      public ImpersonationController(ITokenManagementService tokenManagementService, ILoggerFactory loggerFactory, UserManager&lt;MyUser&gt; userManager)
      {
          _tokenManagementService = tokenManagementService;
          _userManager = userManager;
          _logger = loggerFactory.CreateLogger&lt;ImpersonationController&gt;();
      }
  
      [HttpPost]
      [Route("~/api/impersonation/token")]
      [ProducesResponseType(typeof(AuthenticationResponse), 200)]
      [ProducesResponseType(typeof(Exception), 500)]
      public async Task&lt;IActionResult&gt; Impersonate([FromBody] string userNameToImpersonate)
      {
          try
          {
              var impersonated = await _userManager.FindByNameAsync(userNameToImpersonate);
              if (impersonated == null) throw new EntityNotFoundException($"Unable to find user '{userNameToImpersonate}' in the data store.");
              var actualUserId = User.UserId();
              var token = await _tokenManagementService.GenerateJwt(impersonated.Id, actualUserId);
              var refresh = await _tokenManagementService.GenerateRefreshToken(impersonated.Id, actualUserId);
              var response = new AuthenticationResponse {AuthenticationToken = token, RefreshToken = refresh};
              return Ok(response);
          }
          catch (Exception ex)
          {
              return new OopsResult(ex);
          }
      }
  }
  </code></pre>
  
  <p>If I run this with the <code>AuthorizeAttribute</code> commented out, I can take a look at the user's claims, and the "cim: true" is in the claims enumeration, but if I run it with the <code>AuthorizeAttribute</code> enabled, I get a 403 Forbidden error.</p>
  
  <p>I tried putting a breakpoint on the line in the <code>ImpersonationHandler</code>:</p>
  
  <pre><code>if (context.User.CanImpersonate()) context.Succeed(requirement);
  </code></pre>
  
  <p>...but the debugger never stops here, so I don't know what the problem is.  Can someone educate me as to what I'm doing wrong?</p>