title: Implement one general Authorization Service which should be called when I put Authorize attribute on it in multiple applications/APIs
body: <p>Has anyone an idear what to use as a general Authorization Service and have an working code example or good implementation steps how to implement such of thing.</p>
  <p>It takes a lot of time to look what I am after, but didn't found any satisfied solution yet.</p>
  <p>IdentityServer is not an option, while my permissions can not be stored as claims, because of the size of the token. It comes with about 200 persmissions, so it should be done in a dbcontext or something.</p>
  <p>I looked at the PolicyServer, but it wasn't working as I expected. When I installed it at the IS4 application, it works on the IS4 controllers, but when the Authorize is called from an external application, it doesn't call the Authorize override at all were it should check the permissions.
  And it seems that the permissions aren't set in the external application either in the User.Claims or what so ever. I'm missing some settings I think.</p>
  <p>What I want to accomplish is that I have one permissions store (table) (which for example contains a bunch of index, add, edit or delete button or what so ever). The should be given to the autheniticated user which is logged in. But this single persmission-store should be available at all applications or APIs I run, so that the Authorize attribute can do his job.</p>
  <p>I think it shouldn't be so hard to do, so I'm missing a good working example how to implement something like this and what is working.
  Who can help me with this to get this done?</p>
  <p>I wrote some code to get the permissions by API call and use that in the IsInRole override. But when I declare it with the Authorize attr, it will not get in the method:</p>
  <pre class="lang-cs prettyprint-override"><code>[ApiController]
  1) [Authorize]
  public class AuthController : ControllerBase
  {
  private readonly IdentityContext _context;
  public AuthController(IdentityContext context)
  {
     _context = context ?? throw new ArgumentNullException(nameof(context));
  }
  
  [HttpGet()]
  [Route(&quot;api/auth/isinrole&quot;)]
  public bool IsInRole(string role)
  {
  2) if (User.FindFirst(&quot;sub&quot;)?.Value != null)
     {
        var userID = Guid.Parse(User.FindFirst(&quot;sub&quot;)?.Value);
        if([This is the code that checks if user has role])
           return true;
     }
     return false;
  </code></pre>
  <p>This is the IsInRole override (ClaimsPrincipal.IsInRole override):</p>
  <pre class="lang-cs prettyprint-override"><code>public override bool IsInRole(string role)
  {
      var httpClient = _httpClientFactory.CreateClient(&quot;AuthClient&quot;);
  3)  var accessToken = _httpContextAccessor.HttpContext.GetTokenAsync(OpenIdConnectParameterNames.AccessToken).Result; 
  
      httpClient.DefaultRequestHeaders.Authorization = new AuthenticationHeaderValue(&quot;Bearer&quot;, accessToken);
      var request = new HttpRequestMessage(HttpMethod.Get, &quot;/api/auth/isinrole/?id=&quot; + role);
      var response = httpClient.SendAsync(request, HttpCompletionOption.ResponseHeadersRead).Result;
  
  etc...
  
  </code></pre>
  <ol>
  <li>This isn't working while it is not sending the access_token in the request</li>
  <li>The 'sub' isn't send</li>
  <li>Is always null</li>
  </ol>