AspNetCore.Docs/aspnetcore/security/authorization/introduction.md

28 lines
1.5 KiB
Markdown
Raw Normal View History

2016-10-29 01:35:15 +08:00
---
title: Introduction to authorization
2016-10-29 01:35:15 +08:00
author: rick-anderson
description: This document provides a basic explanation of authorization and explains how authorization relates to ASP.NET Core.
2016-10-29 01:35:15 +08:00
ms.author: riande
manager: wpickett
ms.date: 10/14/2016
ms.topic: article
2016-11-17 08:24:57 +08:00
ms.technology: aspnet
ms.prod: asp.net-core
2016-10-29 01:35:15 +08:00
uid: security/authorization/introduction
---
# Introduction
2017-10-14 04:50:30 +08:00
<a name="security-authorization-introduction"></a>
2016-10-29 01:35:15 +08:00
2016-12-04 10:04:32 +08:00
Authorization refers to the process that determines what a user is able to do. For example, an administrative user is allowed to create a document library, add documents, edit documents, and delete them. A non-administrative user working with the library is only authorized to read the documents.
2016-10-29 01:35:15 +08:00
Authorization is orthogonal and independent from authentication, which is the process of ascertaining who a user is. Authentication may create one or more identities for the current user.
## Authorization Types
ASP.NET Core authorization provides a simple declarative [role](roles.md) and a [rich policy based](policies.md) model. Authorization is expressed in requirements, and handlers evaluate a user's claims against requirements. Imperative checks can be based on simple policies or policies which evaluate both the user identity and properties of the resource that the user is attempting to access.
2016-10-29 01:35:15 +08:00
## Namespaces
Authorization components, including the `AuthorizeAttribute` and `AllowAnonymousAttribute` attributes are found in the `Microsoft.AspNetCore.Authorization` namespace.