SharePoint Stack Exchange is a question and answer site for SharePoint enthusiasts. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How can i restrict a user from entering SharePoint - unless he is using my custom application?

For example, a user tries to open http://Mysite , he gets an access denied error.

But as the same time, i need to use the credentials of the same user in order to access Sharepoint site http://Mysite using my custom application (using the SharePoint Object Model).

I want to make sure that this user is only used by my application and that no one can login to sharepoint using this user from outside my application.

share|improve this question

You could develop a custom SharePoint DelegateControl which checks for the current user and denies access to any ASPX page if it is your special user.

Such a control can be added via a feature to the placeholder "AdditionalPageHead" and stapled to any site of your choice without touching a masterpage or site definition.

This, rather simple, approach would prevent access to any *.aspx Webpage but wouldn't stop from syncing a list with Outlook, SharePoint Workspace or accessing it via the client object model.

More info on custom SharePoint DelegateControls and how to staple them on the placeholder "AdditionalPageHead" can be found here:

and here:

How can I enable JavaScript on every page at a site level?

For an absolute foolproof way you should look into setting appropriate permissions as @Paul Schaeflein mentions, by creating a custom role definition which only allows API access but prevents opening pages in a Web browser.

share|improve this answer

I think you are talking about .Net impersonation. Please visit this blog for detailed info on the same.

share|improve this answer
I don't want to impersonate a user, i want to restrict access to this user from anywhere except from my application. – Zee99 Mar 5 '12 at 11:05

You will need to follow the model of a trusted identity subsystem. That is a lot of work.

The requirement does not make much sense. You should push back to understand what is visible in the browser that caused it. Then, set permissions around that securable object.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.