title: Conditional AccessDeniedPath in ASP.NET Core 3.1
body: <p>My project has two controllers to support users from different roles - <strong>Members</strong> and <strong>Consultants.</strong> On sign-in I set the &quot;Role&quot; <em>ClaimType</em> for each.</p>
  <p>There is a different sign-in page for members and consultants and after sign-in both the <strong>MemberController</strong> and <strong>ConsultantController</strong> redirect to a &quot;Desktop&quot; action.</p>
  <p><strong>CONSULTANTCONTROLLER.CS</strong></p>
  <pre><code>    [HttpPost()]
      [AllowAnonymous]
      [ValidateAntiForgeryToken]
      public async Task&lt;ActionResult&gt; SignIn(SignIn sin)
      {
          try
          {
              // check authorisation
              if (ModelState.IsValid)
              {
                  sin = await RepoSamadhi.ShopSignIn(sin);
                  if (sin.ShopID == 0 || sin.IsValidationFail || string.IsNullOrEmpty(sin.ShopToken))
                  {
                      is_err = true;
                      _logger.LogInformation(&quot;Consultant SignIn Invalid Credentials&quot;, sin.EmailAddress);                        
                      ModelState.AddModelError(&quot;Consultant&quot;, &quot;Account not found. Check your credentials.&quot;);
                  }
              }                
              else
              {
                  sin.IsSignInFailed = true;
                  return View(&quot;SignIn&quot;, sin);
              }
  
              // create claims
              var claims = new List&lt;Claim&gt;
          {
              new Claim(ClaimTypes.Sid, sin.ShopToken),
              new Claim(ClaimTypes.NameIdentifier, sin.ShopID.ToString()),
              new Claim(ClaimTypes.Email, sin.EmailAddress.ToLower()),
              new Claim(ClaimTypes.Role, &quot;Consultant&quot;)
          };
  
              // create identity
              var identity = new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme); // cookie or local            
  
              // create principal
              ClaimsPrincipal principal = new ClaimsPrincipal(new ClaimsIdentity(claims, CookieAuthenticationDefaults.AuthenticationScheme));
  
              // create auth properties
              var authProperties = new AuthenticationProperties
              {
                  IsPersistent = sin.RememberMe;
              };
  
              // sign-in
              await HttpContext.SignInAsync(scheme: CookieAuthenticationDefaults.AuthenticationScheme, principal: principal, properties: authProperties);
          }
          catch (Exception ex)
          {
              gFunc.ProcessError(ex);
          }
          return RedirectToAction(&quot;Desktop&quot;, new { date = DateTime.Today.ToString(&quot;d MMM yyyy&quot;), timer = false });
      }
  </code></pre>
  <p><strong>STARTUP.CS</strong></p>
  <pre><code>    public void ConfigureServices(IServiceCollection services)
      {
          try
          {
              services.AddRazorPages()
                  .AddRazorRuntimeCompilation();
  
              services.AddControllersWithViews();
  
              services.AddAuthentication(CookieAuthenticationDefaults.AuthenticationScheme)
                  .AddCookie(CookieAuthenticationDefaults.AuthenticationScheme, options =&gt;
                  {
                      options.ExpireTimeSpan = new TimeSpan(30, 0, 0, 0);
                      options.LoginPath = new PathString(&quot;/Home/Index/&quot;);
                      options.AccessDeniedPath = new PathString(&quot;/Home/Index/&quot;);
                      options.LogoutPath = new PathString(&quot;/Home/Index/&quot;);
                      options.Validate();
                  });
  
              services.Configure&lt;Microsoft.AspNetCore.Identity.IdentityOptions&gt;(options =&gt;
              {
                  options.Password.RequireDigit = true;
                  options.Password.RequireLowercase = true;
                  options.Password.RequireNonAlphanumeric = true;
                  options.Password.RequireUppercase = true;
                  options.Password.RequiredLength = 8;
                  options.Password.RequiredUniqueChars = 1;
                  options.Lockout.DefaultLockoutTimeSpan = TimeSpan.FromMinutes(5);
                  options.Lockout.MaxFailedAccessAttempts = 5;
                  options.Lockout.AllowedForNewUsers = true;
                  options.User.AllowedUserNameCharacters = &quot;abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789-._@+&quot;;
                  options.User.RequireUniqueEmail = false;
              });
  
              // add detection services container and device resolver service
              services.AddDetectionCore()
                  .AddDevice();
  
              services.AddMvc();
              services.AddAntiforgery();
              services.Configure&lt;MvcOptions&gt;(options =&gt;
              {
                  options.Filters.Add(new RequireHttpsAttribute());
              });
          }
          catch (Exception ex)
          {
              gFunc.ProcessError(ex);
          }
      }
  </code></pre>
  <p><strong>QUESTION</strong></p>
  <p>How can I configure the Authentication service to redirect the user to the correct SignIn page when they attempt to access an Authorize resource) but are not signed in (ie. no valid authentication cookie)? At the moment I have just one &quot;AccessDeniedPath&quot; and it takes the user to the home page.</p>