title: Dependency Injection on Authorization Policy
body: <p>I want to create a claim based authorization for my ASP.NET Core app:</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
  {
      services.AddAuthorization(options =&gt;
      {
          options.AddPolicy("Founders", policy =&gt;
                            policy.RequireClaim("EmployeeNumber", "1", "2", "3", "4", "5"));
      });
  }
  </code></pre>
  
  <p>The problem is that I have a non trivial method to resolve the employee numbers (1 to 5) and I want to use a DI service:</p>
  
  <pre><code>public interface IEmployeeProvider {
  
    string[] GetAuthorizedEmployeeIds();
  }
  </code></pre>
  
  <p>I would like to inject this service and use it in AddPolicy, something like:</p>
  
  <pre><code>services.AddAuthorization(options =&gt;
  {
      options.AddPolicy("Founders", policy =&gt;
                policy.RequireClaim("EmployeeNumber", *employeeProvider.GetAuthorizedEmployeeIds()));
  });
  </code></pre>
  
  <p><strong>Note</strong></p>
  
  <p>I know that I can write my own AuthorizationHandler where I can easily inject <code>IEmployeeProvider</code> but I'm against this pattern because:</p>
  
  <ol>
  <li>There is a already a handler that does exactly what I need</li>
  <li>I need to write a new handler for each claim type and each different requirement</li>
  <li>This is an anti pattern because the employee ids should really be part of the requirement while the handler should be generic component that handles the requirements</li>
  </ol>
  
  <p>So I'm looking for a way to inject services when the policy is being built</p>