基于角色的授权属性在ASP.NET核心MVC中不起作用

services.AddAuthorization(options =>
{
    options.AddPolicy("RequireAdminRole", policy =>
        policy.RequireRole("Admin"));
});

[Authorize(Policy = "RequireAdminRole")]
public IActionResult AdminOnlyAction()
{
    // 只有"Admin"角色的用户才能访问此操作方法
    return View();
}

private readonly UserManager<ApplicationUser> _userManager;
private readonly RoleManager<IdentityRole> _roleManager;

public MyController(UserManager<ApplicationUser> userManager, RoleManager<IdentityRole> roleManager)
{
    _userManager = userManager;
    _roleManager = roleManager;
}

[Authorize(Policy = "RequireAdminRole")]
public IActionResult AdminOnlyAction()
{
    var user = await _userManager.GetUserAsync(HttpContext.User);
    
    if (!await _userManager.IsInRoleAsync(user, "Admin"))
    {
        return Forbid();
    }
    
    // 用户被授权到"Admin"角色，可以访问此操作方法
    return View();
}

public void ConfigureServices(IServiceCollection services)
{
    // 添加身份认证服务
    services.AddAuthentication(options =>
    {
        options.DefaultAuthenticateScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultSignInScheme = CookieAuthenticationDefaults.AuthenticationScheme;
        options.DefaultChallengeScheme = CookieAuthenticationDefaults.AuthenticationScheme;
    })
    .AddCookie(options =>
    {
        options.LoginPath = "/Account/Login"; // 登录页面的路径
    });

    // 其他服务配置...
}

public void Configure(IApplicationBuilder app, IWebHostEnvironment env)
{
    // 启用身份认证中间件
    app.UseAuthentication();

    // 其他中间件配置...
}