I followed the MSDN post on implementing a claim-based authorization. https://msdn.microsoft.com/en-us/library/system.security.claims.claimsauthorizationmanager(v=vs.110).aspx
It uses XML configuration in Web.config to define policies.
- Can the policies be stored and pulled from database instead of file?
- If not, can this be done in another file?
LoadCustomConfiguration - When overridden in a derived class, loads custom configuration from XML.
ClaimsAuthorizationManager pull policies from database is the same question but contains no answer for database implementation or reading it from another xml file other than web.config.