title: How can I implement Claims-Based Authorization with ASP.NET WebAPI without using Roles?
body: <p>I have an ASP.Net WebAPI 2 Application that uses Claims. The claims are stored as two additional columns in a standard Identity2 AspNetUsers table:</p>
  
  <pre><code>CREATE TABLE [dbo].[AspNetUsers] (
      [Id]                   INT            IDENTITY (1, 1) NOT NULL,
      ....
      [SubjectId]            INT            DEFAULT ((0)) NOT NULL,
      [LocationId]           INT            DEFAULT ((0)) NOT NULL,
      CONSTRAINT [PK_dbo.AspNetUsers] PRIMARY KEY CLUSTERED ([Id] ASC)
  );
  </code></pre>
  
  <p>I have modified the ApplicationUser class like this:</p>
  
  <pre><code>public class ApplicationUser : IdentityUser&lt;int, CustomUserLogin, CustomUserRole, CustomUserClaim&gt;
      {
          public async Task&lt;ClaimsIdentity&gt; GenerateUserIdentityAsync(ApplicationUserManager manager, string authenticationType)
          {
              // Note the authenticationType must match the one defined in CookieAuthenticationOptions.AuthenticationType
              ClaimsIdentity userIdentity = await manager.CreateIdentityAsync(this, authenticationType);
              // Add custom user claims here
              userIdentity.AddClaim(new Claim("SubjectId", this.SubjectId.ToString()));
              userIdentity.AddClaim(new Claim("LocationId", this.LocationId.ToString()));
              return userIdentity;
          }
  
          public int SubjectId { get; set; }
          public int LocationId { get; set; }
  
      }
  </code></pre>
  
  <p>In my register method I add in new data for the SubjectId:</p>
  
  <pre><code>    var user = new ApplicationUser() { 
          UserName = model.UserName, 
          SubjectId = 25,
          LocationId = 4
      };
  
      IdentityResult result = await UserManager.CreateAsync(user, model.Password);
  </code></pre>
  
  <p>Can someone help tell me how I can now go about restricting access to a controller based on this SubjectId at the controller level and also at the method level with something similar to this:</p>
  
  <pre><code>[Authorize(SubjectId = "1,25,26")]
  [RoutePrefix("api/Content")]
  public class ContentController : BaseController
  {
  
      [Authorize(LocationId = "4")]
      [Route("Get")]
      public IQueryable&lt;Content&gt; Get()
      {
          return db.Contents;
      }
  
      [Authorize(SubjectId = "25")]
      [Route("Get/{id:int}")]
      public async Task&lt;IHttpActionResult&gt; Get(int id)
      {
          Content content = await db.Contents.FindAsync(id);
          if (content == null)
          {
              return NotFound();
          }
          return Ok(content);
      }
  </code></pre>
  
  <p>For months now I have been looking for an example but other than some reference to ThinkTexture product and the following link I have found nothing</p>
  
  <p>Update:</p>
  
  <pre><code>#region Assembly System.Web.Http.dll, v5.2.2.0
  // C:\Users\Richard\GitHub\abilitest-server\packages\Microsoft.AspNet.WebApi.Core.5.2.2\lib\net45\System.Web.Http.dll
  #endregion
  
  using System;
  using System.Web.Http.Controllers;
  using System.Web.Http.Filters;
  
  namespace System.Web.Http
  {
      // Summary:
      //     Specifies the authorization filter that verifies the request's System.Security.Principal.IPrincipal.
      [AttributeUsage(AttributeTargets.Class | AttributeTargets.Method, Inherited = true, AllowMultiple = true)]
      public class AuthorizeAttribute : AuthorizationFilterAttribute
      {
          // Summary:
          //     Initializes a new instance of the System.Web.Http.AuthorizeAttribute class.
          public AuthorizeAttribute();
  
          // Summary:
          //     Gets or sets the authorized roles.
          //
          // Returns:
          //     The roles string.
          public string Roles { get; set; }
          //
          // Summary:
          //     Gets a unique identifier for this attribute.
          //
          // Returns:
          //     A unique identifier for this attribute.
          public override object TypeId { get; }
          //
          // Summary:
          //     Gets or sets the authorized users.
          //
          // Returns:
          //     The users string.
          public string Users { get; set; }
  
          // Summary:
          //     Processes requests that fail authorization.
          //
          // Parameters:
          //   actionContext:
          //     The context.
          protected virtual void HandleUnauthorizedRequest(HttpActionContext actionContext);
          //
          // Summary:
          //     Indicates whether the specified control is authorized.
          //
          // Parameters:
          //   actionContext:
          //     The context.
          //
          // Returns:
          //     true if the control is authorized; otherwise, false.
          protected virtual bool IsAuthorized(HttpActionContext actionContext);
          //
          // Summary:
          //     Calls when an action is being authorized.
          //
          // Parameters:
          //   actionContext:
          //     The context.
          //
          // Exceptions:
          //   System.ArgumentNullException:
          //     The context parameter is null.
          public override void OnAuthorization(HttpActionContext actionContext);
      }
  }
  </code></pre>