Skip to content

Role-based authorization overhaul#36885

Merged
guardrex merged 21 commits into
mainfrom
guardrex/role-based-auth-overhaul
Mar 24, 2026
Merged

Role-based authorization overhaul#36885
guardrex merged 21 commits into
mainfrom
guardrex/role-based-auth-overhaul

Conversation

@guardrex
Copy link
Copy Markdown
Collaborator

@guardrex guardrex commented Mar 17, 2026

Fixes #36868
Fixes #34468
Fixes #34879
Fixes #32489

Wade, I sent Stephen an email asking for review. There's enough authz 🧀 moving around here with new content coming in that I think his 👀 on this one makes sense. It might take him a minute to reach this. I suggest we go ahead with our review whenever you're ready. No rush on this one. I'll move on to my next Blazorfy IT!™ effort 😄.

Notes

  • The samples here are only used for code snippets, and they aren't particularly good cluttering up the repo for the small gain of a few line highlights. I'm 💀 them.
  • The main doc set article now has Blazor examples, and new RP and MVC articles for this have RP and MVC examples.
  • Adding explicit coverage for Razor Pages handler methods, which can't take an [Authorize] attribute. I'm guiding readers to either use separate pages or call IAuthorizationService.AuthoizeAsync/User.IsInRole in handler methods of a page model class.

Additional issues resolved:

  • 34468 and 34879 are resolved by a new Windows Authentication security groups as app roles section.
  • 32489 is resolved by the PR updating the versioning of use of AuthorizationBuilder. It became available at 7.0. Prior to 7.0, AddAuthorization(options => { ... } was in use with builder.Services in the Program file. Prior to 6.0, it would be AddAuthorization(options => { ... } with services in Startup.ConfigureServices. This is all versioned on the PR now within the sections.

Internal previews

📄 File 🔗 Preview link
aspnetcore/blazor/security/index.md aspnetcore/blazor/security/index
aspnetcore/blazor/security/webassembly/microsoft-entra-id-groups-and-roles-net-5-to-7.md aspnetcore/blazor/security/webassembly/microsoft-entra-id-groups-and-roles-net-5-to-7
aspnetcore/blazor/security/webassembly/microsoft-entra-id-groups-and-roles.md aspnetcore/blazor/security/webassembly/microsoft-entra-id-groups-and-roles
aspnetcore/fundamentals/static-files.md aspnetcore/fundamentals/static-files
aspnetcore/mvc/security/authorization/roles.md aspnetcore/mvc/security/authorization/roles
aspnetcore/razor-pages/security/authorization/roles.md aspnetcore/razor-pages/security/authorization/roles
aspnetcore/security/authorization/claims.md aspnetcore/security/authorization/claims
aspnetcore/security/authorization/roles.md aspnetcore/security/authorization/roles
aspnetcore/security/authorization/simple.md aspnetcore/security/authorization/simple

@guardrex guardrex self-assigned this Mar 17, 2026

This comment was marked as outdated.

Comment thread aspnetcore/security/authorization/simple.md Outdated
guardrex and others added 4 commits March 18, 2026 14:45
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Luke Latham <1622880+guardrex@users.noreply.github.com>
@guardrex guardrex requested a review from Copilot March 18, 2026 19:18

This comment was marked as outdated.

guardrex and others added 4 commits March 18, 2026 15:26
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
@guardrex guardrex requested a review from Copilot March 18, 2026 20:03

This comment was marked as outdated.

@guardrex guardrex marked this pull request as ready for review March 19, 2026 15:23
@guardrex guardrex requested a review from Copilot March 19, 2026 15:26
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR refreshes and restructures role-based authorization guidance across ASP.NET Core docs, emphasizing Blazor examples in the main article and adding dedicated Razor Pages and MVC role-authorization articles. It also removes older sample projects that were primarily used for snippet extraction.

Changes:

  • Updated the main role-based authorization article to focus on Blazor and added versioned guidance for AddAuthorizationBuilder vs AddAuthorization.
  • Added new dedicated role-based authorization articles for Razor Pages and MVC.
  • Removed multiple legacy WebAll sample projects/files (6.0/7.x/2.2/3.0) that were used mainly for snippet highlighting.

Reviewed changes

Copilot reviewed 83 out of 83 changed files in this pull request and generated 7 comments.

Show a summary per file
File Description
aspnetcore/security/authorization/simple.md Adds moniker range and clarifies the article’s Blazor focus and version framing.
aspnetcore/security/authorization/roles.md Reworks role-based authorization guidance around Blazor components and adds versioned policy configuration and Windows auth group guidance.
aspnetcore/razor-pages/security/authorization/roles.md New Razor Pages-specific role authorization article with handler-method guidance.
aspnetcore/mvc/security/authorization/roles.md New MVC-specific role authorization article with controller/action examples.
aspnetcore/blazor/security/index.md Improves xref display formatting for AuthorizeView and [Authorize] role/policy parameters.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/appsettings.json Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/appsettings.Development.json Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/WebAll.csproj Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/_ViewStart.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/_ViewImports.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Vacation/VacationPolicy.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Vacation/VacationBalance.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/x_Layout.cshtml.css Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/x_Layout.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/_ValidationScriptsPartial.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/Error.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Salary/Index.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Home2/Privacy.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Home2/Index.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/README.md Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Program.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/_ViewStart.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/_ViewImports.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/X/Update.cshtml.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/X/Update.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Shared/_ValidationScriptsPartial.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Shared/_Layout.cshtml.css Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Shared/_Layout.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Privacy.cshtml.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Privacy.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Index.cshtml.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Index.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Error.cshtml.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Error.cshtml Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Models/ErrorViewModel.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/VacationController.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/SalaryController.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/Home2Controller.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/ControlPanelController.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/ControlAllPanelController2.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/ControlAllPanelController.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/Control3PanelController.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/AdministrationController.cs Removes legacy 7.x WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/appsettings.json Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/appsettings.Development.json Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/WebAll.csproj Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/_ViewStart.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/_ViewImports.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Vacation/VacationPolicy.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Vacation/VacationBalance.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/x_Layout.cshtml.css Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/x_Layout.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/_ValidationScriptsPartial.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/Error.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Salary/Index.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Home2/Privacy.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Home2/Index.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/README.md Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Program.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/_ViewStart.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/_ViewImports.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/X/Update.cshtml.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/X/Update.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Shared/_ValidationScriptsPartial.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Shared/_Layout.cshtml.css Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Shared/_Layout.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Privacy.cshtml.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Privacy.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Index.cshtml.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Index.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Error.cshtml.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Error.cshtml Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Models/ErrorViewModel.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/VacationController.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/SalaryController.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/Home2Controller.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/ControlPanelController.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/ControlAllPanelController2.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/ControlAllPanelController.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/Control3PanelController.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/AdministrationController.cs Removes legacy 6.0 WebAll sample artifact.
aspnetcore/security/authorization/roles/samples/3_0/Startup.cs Removes legacy 3.0 sample used for snippet extraction.
aspnetcore/security/authorization/roles/samples/2_2/Startup.cs Removes legacy 2.2 sample used for snippet extraction.

Comment thread aspnetcore/security/authorization/simple.md
Comment thread aspnetcore/security/authorization/simple.md Outdated
Comment thread aspnetcore/security/authorization/roles.md
Comment thread aspnetcore/security/authorization/roles.md Outdated
Comment thread aspnetcore/security/authorization/roles.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md Outdated
@wadepickett
Copy link
Copy Markdown
Contributor

@guardrex, thanks. Keep in mind we also use the full samples to test more extensive code examples used inthe doc, know what was tested and to quickly check it again at the next major update. It is not just for the sake of commnity download. Tiny stuff doesn't warrent a fuill sample of course.

Comment thread aspnetcore/mvc/security/authorization/roles.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md Outdated
Comment thread aspnetcore/security/authorization/roles.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md
@wadepickett
Copy link
Copy Markdown
Contributor

I don't think these were testable/usable because the apps have no provision to make role claims (i.e., they don't actually authenticate users for access to the apps). AFAICT, they were only providing code snippets. I'll check again tomorrow morning and report back.

Actually, I DO see Identity infrastructure. Not sure about how runnable they are tho. Let me see in the morning if they run. If so, I'll merely move them to the samples repo and add back the section that calls them out to readers. In the process, I'll make 10.0 versions of them.

We'd need to make a decision tho about carrying yet another sample 😩 ... a Blazor Web App version that demos the content. I mean there are getting to be way, way more samples than this group can ever hope to adequately maintain.

WRT taking the code snippets from them tho ... I don't think it's worth the trouble for a handful of line highlights that aren't particularly helpful. The snippets are short, highly unlikely to change, and can be described very well by the text without highlights. Further, it's simpler to see/edit them inline. Still tho ... if you prefer them be pulled from sample apps ... it's your call.

Its a balance, and up to you. I just wanted to note that samples are not just for customer downloads. We don't need a full sample for everything, but we also need a way to verify entensive code used in a doc still works and even compiles.

Comment thread aspnetcore/security/authorization/roles.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md Outdated
Copy link
Copy Markdown
Contributor

@wadepickett wadepickett left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved. Looks good, but I suggested some minor corrections. Great work!

guardrex and others added 2 commits March 20, 2026 09:01
Co-authored-by: Wade Pickett <wpickett@microsoft.com>
@guardrex
Copy link
Copy Markdown
Collaborator Author

guardrex commented Mar 20, 2026

cc: @danroth27 and @cmastr for assistance. TL;DR ... The sample for the roles-based auth article is old and has problems for use with the updated main doc set coverage, which is adopting 100% Razor component examples now. The samp even has problems for use with the new split MVC and RP versions back in their respective security nodes. We're trying to figure out what to do about the sample(s) for the three roles-based security articles.

@wadepickett ... Took a closer look. There are several problems with the current sample app ...

  • It's a combo MVC/RP app with about eight or nine examples in MVC controllers and about two or three examples in RP.
  • The one Program file section that has Identity infrastructure has a doc author note that reads, "This won't build in this project." No packages were added to support Identity, so I'm not sure why that version of the app's startup code was placed. My original understanding was correct: This sample never was able to actually demo anything about roles-based authz to devs. If we wanted to make it runnable (and useful to devs), we must scaffold Identity into the app properly (or go the JWT bearer/CURL approach, like we use in the Custom authorization policies with IAuthorizationRequirementData article ... not really a favorite 🦖 approach tho for this type of coverage). The other two compiler-directive sections of the Program file have no Identity infrastructure, so they were never runnable as demos to test the authz code in the app. It seems like under those two scenarios that the samp was only supplying code snippets and making sure that the authz API would compile.
  • Note in passing that I understand the utility of compiler directives to activate alternative versions of sample code in apps like this one, but I've always felt that the approach is probably confusing to new devs and new-to-.NET-devs. I've completely avoided the approach in Blazor samples to good effect IMO.
  • The latest version targets 7.0. It would need to be updated to 10.0, as 7.0 has been out-of-support since May, 2024.
  • To align sample code with the articles under the new split guidance paradigm (and especially if you want samples to supply code with line highlights), we need three new samps ... an MVC samp with code that matches the new MVC article, an RP sample with all of these examples in pages mirroring the RP article examples, and a BWA with Razor component examples that match the guidance in the main doc set article. However, we could just go with one samp, a BWA with Razor component examples, and let the MVC/RP go with only inline snippets, given that the focus is on Blazor as the flagship UI stack.

I'm leaning toward at least creating a BWA 10.0 sample to go with the main doc set article. Does everyone concur? If you would also like MVC and RP samps, mirroring the API shown in those articles and supplying code snippets to them with line highlights, I certainly can whip those up.

@wadepickett
Copy link
Copy Markdown
Contributor

wadepickett commented Mar 20, 2026

cc: @danroth27 and @cmastr for assistance. TL;DR ... The sample for the roles-based auth article is old and has problems for use with the updated main doc set coverage, which is adopting 100% Razor component examples now. The samp even has problems for use with the new split MVC and RP versions back in their respective security nodes. We're trying to figure out what to do about the sample(s) for the three roles-based security articles.

@wadepickett ... Took a closer look. There are several problems with the current sample app ...

Thanks for the deep dive on the sample app Luke, that's really helpful context. To clarify for anyone following along: the sample app issues described here are about the existing companion sample that lives alongside the current docs, not something introduced or reviewed in this PR but related to the overall goal.

I agree we should prioritize a single Blazor Web App sample with Razor component examples and keep MVC/Razor Pages as inline snippets only, rather than investing in three separate sample apps.

I'm not real up on this old sample yet, Rick had originally provided it, I need to catch up.

The current 7.0 sample does not seem worth salvaging given the broken Identity setup and the non-runnable compiler-directive scenarios.

A single Blazor Web App sample makes the most sense for maintenance and dev experience.
If MVC/RP demand grows later for some reason, we can always add dedicated samples then.

@guardrex
Copy link
Copy Markdown
Collaborator Author

guardrex commented Mar 20, 2026

I agree, @wadepickett! 👍 I still have two hours left, so I'm going to work on a BWA sample companion for the main doc set article to demo the features described. If don't have that posted today, it will be posted for review on Monday.

Comment thread aspnetcore/security/authorization/roles.md Outdated
Copy link
Copy Markdown
Member

@halter73 halter73 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This looks good! My biggest feedback is to split the paragraphs that introduce the case sensitivity of roles and case insensitivity of policies into separate paragraphs, and to mention the case sensitivity of roles in more places (the MVC and Razor Pages companion articles).

Other than that, I do think we need to discuss the case-sensitivity of claim types in https://github.com/dotnet/AspNetCore.Docs/blob/main/aspnetcore/security/authorization/claims.md, because that's the actually hairy bit. I suggested possible language for that in https://github.com/dotnet/AspNetCore.Docs/pull/36885/changes#r2968415341 while also providing some context. That can definitely be a different PR though.

Co-authored-by: Stephen Halter <halter73@gmail.com>
@guardrex
Copy link
Copy Markdown
Collaborator Author

guardrex commented Mar 23, 2026

@halter73 ... Updates made on the last commit 👇. Thanks for your help and review of the new code bits that I'm adding for WinAuth and RP page handler guidance.

It looks like most of the articles in the main doc set's security node will require at least some ✨ Blazorfication!™ ✨ work, which will typically include moving MVC and RP coverage back to their new security node folders (just like what's happening on this PR). If I run into challenging updates or need to introduce code examples that I'm not 100% confident in, I'll ping you on the PR and via email.

Thanks for your review and recommendations, @wadepickett.

I have one task left here: I need to wrap up the new BWA sample app to go with this and add a blurb on it to the article. Outside of that, we'll be good to go here, and I'll merge this shortly. Done! 🍻 dotnet/AspNetCore.Docs.Samples#294

Copilot has identified a few more NITs to address. I'll take care of them by tomorrow morning.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR restructures and modernizes the role-based authorization documentation set by shifting the main article to Blazor-focused guidance, adding dedicated Razor Pages and MVC articles, and removing repo-local sample projects that were only used for snippet extraction.

Changes:

  • Refactors security/authorization/roles.md to focus on Blazor role/policy authorization patterns and adds Windows Authentication security group guidance.
  • Adds new role-based authorization articles for Razor Pages and MVC with versioned guidance.
  • Removes legacy roles/samples/* projects and adds supporting doc updates (claim case-sensitivity note, minor formatting updates, metadata updates).

Reviewed changes

Copilot reviewed 87 out of 87 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
aspnetcore/security/authorization/simple.md Adds moniker range metadata to the simple authorization article.
aspnetcore/security/authorization/roles.md Rewrites the main roles article to focus on Blazor scenarios, adds new sections, and updates versioned guidance.
aspnetcore/security/authorization/claims.md Adds a new section describing claim case-sensitivity considerations.
aspnetcore/razor-pages/security/authorization/roles.md New Razor Pages-specific role authorization article.
aspnetcore/mvc/security/authorization/roles.md New MVC-specific role authorization article.
aspnetcore/blazor/security/index.md Updates role/policy parameter xref display and case-sensitivity guidance wording.
aspnetcore/blazor/security/webassembly/microsoft-entra-id-groups-and-roles.md Updates role/policy case-sensitivity guidance and links to the new claims section.
aspnetcore/blazor/security/webassembly/microsoft-entra-id-groups-and-roles-net-5-to-7.md Updates role/policy case-sensitivity guidance and links to the new claims section.
aspnetcore/fundamentals/static-files.md Minor formatting tweak for inline role name formatting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/appsettings.json Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/appsettings.Development.json Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/WebAll.csproj Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/_ViewStart.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/_ViewImports.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Vacation/VacationPolicy.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Vacation/VacationBalance.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/x_Layout.cshtml.css Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/x_Layout.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/_ValidationScriptsPartial.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Shared/Error.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Salary/Index.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Home2/Privacy.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Views/Home2/Index.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/README.md Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Program.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/_ViewStart.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/_ViewImports.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/X/Update.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/X/Update.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Shared/_ValidationScriptsPartial.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Shared/_Layout.cshtml.css Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Shared/_Layout.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Privacy.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Privacy.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Index.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Index.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Error.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Pages/Error.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Models/ErrorViewModel.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/VacationController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/SalaryController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/Home2Controller.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/ControlPanelController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/ControlAllPanelController2.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/ControlAllPanelController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/Control3PanelController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/7.x/WebAll/Controllers/AdministrationController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/appsettings.json Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/appsettings.Development.json Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/WebAll.csproj Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/_ViewStart.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/_ViewImports.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Vacation/VacationPolicy.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Vacation/VacationBalance.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/x_Layout.cshtml.css Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/x_Layout.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/_ValidationScriptsPartial.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Shared/Error.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Salary/Index.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Home2/Privacy.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Views/Home2/Index.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/README.md Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Program.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/_ViewStart.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/_ViewImports.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/X/Update.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/X/Update.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Shared/_ValidationScriptsPartial.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Shared/_Layout.cshtml.css Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Shared/_Layout.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Privacy.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Privacy.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Index.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Index.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Error.cshtml.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Pages/Error.cshtml Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Models/ErrorViewModel.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/VacationController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/SalaryController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/Home2Controller.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/ControlPanelController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/ControlAllPanelController2.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/ControlAllPanelController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/Control3PanelController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/6_0/WebAll/Controllers/AdministrationController.cs Deletes repo-local sample artifacts previously used for snippet highlighting.
aspnetcore/security/authorization/roles/samples/3_0/Startup.cs Removes older sample source used for snippet inclusion.
aspnetcore/security/authorization/roles/samples/2_2/Startup.cs Removes older sample source used for snippet inclusion.

Comment thread aspnetcore/security/authorization/roles.md
Comment thread aspnetcore/security/authorization/claims.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md
Comment thread aspnetcore/security/authorization/roles.md Outdated
Comment thread aspnetcore/mvc/security/authorization/roles.md Outdated
Comment thread aspnetcore/razor-pages/security/authorization/roles.md Outdated
@guardrex
Copy link
Copy Markdown
Collaborator Author

Lick'd IT! 🐮👅

Looks great! Merging now! 🎉🍻

@wadepickett @tdykstra @cmastr ... Final note on the BWA sample for this and other new main doc set samples ...

I think you're all aware that I keep the Blazor samples for Blazor node articles in the dedicated Blazor samples repo up-to-date. All samples are constituted from the new project templates every release, so devs are getting the latest Blazor goodness for any current release. I don't know if we keep adding Blazor samples to that repo how long I can keep it up, but we'll see. I hope I can keep going with up-to-date samples every release 🤞🍀.

The main doc set samples (over 100 of them) haven't had that level of attention or organization, and I think that there are over 600 samples sprinkled around the main doc set repo, also probably somewhat disorganized and certainly in various states of framework targeting.

The Blazor samples added for this PR and for the IARD article aren't laid out in a folder structure for framework versioning simply because the folder structure is a bit of a mess at the moment generally and not present for the security/authorization node ... YET anyway 😄. It seems like we should (or you should if it's an internal matter) consider the organization of samples there so that I know going forward how you would like new samples placed and old samples organized as I continue with these ✨ Blazorfy IT!™ ✨ issues.

Side Note: Years ago, the plan was that samples would be built automatically every release, but that never came to pass. Even on the Blazor samples repo, I only build the primary pair of samples that provide code snippets to Blazor articles. I think that's worth a discussion as well. It doesn't seem critical to our efforts because we're compiling and checking them as we go, but it's worth a passing mention that automatically building any of the sample apps on modification (via PRs) can be instituted. For the Blazor samples, the approach looks like this ... https://github.com/dotnet/blazor-samples/blob/main/.github/workflows/validate-samples.yml. Just tossing that out there in case it's worth discussion.

Alright ...... thanks for reading my 📖 on this! 🙈😆 I'm merging this now, and I'll pick another ✨ Blazorfy IT!™ ✨ issue to resolve.

@guardrex guardrex merged commit 7792188 into main Mar 24, 2026
4 checks passed
@guardrex guardrex deleted the guardrex/role-based-auth-overhaul branch March 24, 2026 13:06
@wadepickett wadepickett mentioned this pull request Mar 26, 2026
31 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

4 participants