Return to Question

I have a set of application pages stored in the _layouts virtual directory, that I'd like to secure, in order to prevent unauthorized access to the pages, as well as prevent certain actions from being executed.

My authorization structure consists of several AD Security Groups (although this is somewhat flexible, and I could create the groups in SharePoint), each of which, will have a set of application pages that they can access, and actions within each page that the user can execute. Something along these lines:

User Group | Access to Application Pages | Actions
-----------+-----------------------------+-----------------------------------------
A          | Page1.aspx, Page2.aspx      | Page1.aspx->Button1, Page2.aspx->Button2
-----------+-----------------------------+-----------------------------------------
B          | Page1.aspx                  | Page1.aspx->Button3
-----------+-----------------------------+----------------------------------------- 

I've read an article on MSDN, that suggests using SPRoleDefinitions, and verify at Page_PreLoad, for example, if a user has the required roles to access the page, and if not, redirect him to accessdenied.aspx. The same could be done for the actions within each page. However, this solution would require me to drop AD Groups, and store users and groups in SharePoint.

Another solution would be to add location tags to the web.config with allow and deny, although this solution doesn't solve the problem of preventing actions within each page from being executed.

  <location path="_layouts/Page1.aspx">
    <system.web>
      <authorization>
        <allow roles="AD\A,AD\B" />

How can this type of scenario be accomplished? What is the typical configuration used in SharePoint solutions for this use case?

I have a set of application pages stored in the _layouts virtual directory, that I'd like to secure, in order to prevent unauthorized access to the pages, as well as prevent certain actions from being executed.

My authorization structure consists of several AD Security Groups (although this is somewhat flexible, and I could create the groups in SharePoint), each of which, will have a set of application pages that they can access, and actions within each page that the user can execute. Something along these lines:

User Group | Access to Application Pages | Actions
-----------+-----------------------------+-----------------------------------------
A          | Page1.aspx, Page2.aspx      | Page1.aspx->Button1, Page2.aspx->Button2
-----------+-----------------------------+-----------------------------------------
B          | Page1.aspx                  | Page1.aspx->Button3
-----------+-----------------------------+----------------------------------------- 

An article on MSDN, suggests using SPRoleDefinitions, and verify at Page_PreLoad, for example, if a user has the required roles to access the page, and if not, redirect him to accessdenied.aspx. The same could be done for the actions within each page. However, this solution would require me to drop AD Groups, and store users and groups in SharePoint.

Another solution would be to add location tags to the web.config with allow and deny, although this solution doesn't solve the problem of preventing actions within each page from being executed.

  <location path="_layouts/Page1.aspx">
    <system.web>
      <authorization>
        <allow roles="AD\A,AD\B" />

How can this type of scenario be accomplished? What is the typical configuration used in SharePoint solutions for this use case?