ASP.NET Core的AuthorizeAttribute提供了一种在控制器和其操作方法上进行授权的方法。当一个请求来到服务器时，AuthorizeAttribute会检查该请求是否包含正确的授权令牌。它可以通过验证用户的身份（通过用户名和密码等凭据）或令牌（通过OAuth）来确定用户是否被授权访问特定的资源。

具体实现需要以下步骤：

1. 在Startup.cs中设置身份验证方案和策略：

services.AddAuthentication("MyScheme")
    .AddScheme("MyScheme", null);
services.AddAuthorization(options =>
{
    options.AddPolicy("MyPolicy", policy =>
        policy.Requirements.Add(new MyRequirement()));
});

2. 实现Handler和Requirement：

public class MySchemeHandler : AuthenticationHandler
{
    private readonly IHttpContextAccessor _httpContextAccessor;

    public MySchemeHandler(IHttpContextAccessor httpContextAccessor,
        IOptionsMonitor options, ILoggerFactory logger, UrlEncoder encoder,
        ISystemClock clock) : base(options, logger, encoder, clock)
    {
        _httpContextAccessor = httpContextAccessor;
    }

    protected override async Task HandleAuthenticateAsync()
    {
        var identity = new ClaimsIdentity(new[]
        {
            new Claim(ClaimTypes.Name, "test")
        }, MyScheme.SchemeName);

        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, MyScheme.SchemeName);
        return AuthenticateResult.Success(ticket);
    }
}

public class MySchemeOptions : AuthenticationSchemeOptions
{
}

public class MyRequirement : IAuthorizationRequirement
{
    public bool RequiresAuthentication => true;

    public bool RequiresAuthorization => true;
}

public class MyAuthorizationHandler : AuthorizationHandler
{
    protected override async Task HandleRequirementAsync(
        AuthorizationHandlerContext context, MyRequirement requirement)
    {
        var claimsIdentity = context.User.Identity as ClaimsIdentity;
        if (claimsIdentity == null)
        {
            context.Fail();
            return;
        }

        var nameClaim = claimsIdentity.FindFirst(ClaimTypes.Name);
        if (nameClaim == null)
        {
            context.Fail();
            return;
        }

        if (nameClaim.Value == "test")
        {
            context.Succeed(requirement);
            return;
        }

        context.Fail();
    }
}

3. 使用AuthorizeAttribute验证：

[Authorize(Policy = "MyPolicy")]
public IActionResult MyAction()
{
    return Ok();
}

在执行MyAction之前，AuthorizeAttribute会检查身份验证是否成功，如果成功，则调用MyAuthorizationHandler来验证授权。

通过以上实现，我们可以对不同的用户和资源进行授权访问的管理。