Securing Application Pages

Question

I have a set of application pages stored in the _layouts virtual directory, that I'd like to secure, in order to prevent unauthorized access to the pages, as well as prevent certain actions from being executed.

My authorization structure consists of several AD Security Groups (although this is somewhat flexible, and I could create the groups in SharePoint), each of which, will have a set of application pages that they can access, and actions within each page that the user can execute. Something along these lines:

User Group | Access to Application Pages | Actions
-----------+-----------------------------+-----------------------------------------
A          | Page1.aspx, Page2.aspx      | Page1.aspx->Button1, Page2.aspx->Button2
-----------+-----------------------------+-----------------------------------------
B          | Page1.aspx                  | Page1.aspx->Button3
-----------+-----------------------------+----------------------------------------- 

An article on MSDN, suggests using SPRoleDefinitions, and verify at Page_PreLoad, for example, if a user has the required roles to access the page, and if not, redirect him to accessdenied.aspx. The same could be done for the actions within each page. However, this solution would require me to drop AD Groups, and store users and groups in SharePoint.

Another solution would be to add location tags to the web.config with allow and deny, although this solution doesn't solve the problem of preventing actions within each page from being executed.

  <location path="_layouts/Page1.aspx">
    <system.web>
      <authorization>
        <allow roles="AD\A,AD\B" />

How can this type of scenario be accomplished? What is the typical configuration used in SharePoint solutions for this use case?

Answer 1

I've read an article on MSDN, that suggests using SPRoleDefinitions, and verify at Page_PreLoad, for example, if a user has the required roles to access the page, and if not, redirect him to accessdenied.aspx. The same could be done for the actions within each page. However, this solution would require me to drop AD Groups, and store users and groups in SharePoint.

This is what we do on a large number of our apps. For each AD group make a Sharepoint group, and put the AD group in the sharepoint group as the only "user". After that everything else in that paragraph should work out just fine.

Answer 2

I ended up with a solution loosely based on the concept of Role Definitions presented here. Here's a brief description of how this was implemented.

For every AD Security Group, create an SPGroup, whose sole member is the corresponding directory group. Then, create an SPRoleDefinition for each required page access, e.g., Page_1.aspx - Read, and an SPRoleAssignment to link the roles to the sharepoint groups. This can be easily done within a bootstrap feature receiver.

After that, roles can be accessed using the AllRolesForCurrentUser property of SPWeb.

Then, in order to hide the navigation links from the menu, preventing users who do not have the required roles from viewing them, I implemented a custom SiteMapProvider, overriding the IsAccessibleToUser, to use the roles obtained in the aforementioned property. Something along these lines (simplified; in a production environment, you'd use caching, etc.):

    public override bool IsAccessibleToUser(HttpContext context, SiteMapNode node)
    {
        var roles = node.Roles.OfType<string>();
        if (roles.Contains("*")) {
            return true;
        } else {
            SPWeb web = SPContext.Current.Web;
            SPRoleDefinitionBindingCollection allUserRoles = web.AllRolesForCurrentUser;
            foreach (string role in roles) {
                SPRoleDefinition requiredRole = web.RoleDefinitions[role];
                if (allUserRoles.contains(requiredRole)) {
                    return true;
                }
            }
            return false;
        }
    }

Finally, in order to actually prevent users from accessing the page, make every ApplicationPage extend from a base page, whose OnInit event basically verifies that the current site map node is accessible to the user, and if not, redirects the user to the access denied page:

    protected void Page_Init(object sender, EventArgs e)
    {
        if (SiteMap.CurrentNode == null) {
            SPUtility.Redirect(SPUtility.AccessDeniedPage, SPRedirectFlags.RelativeToLayoutsPage,
                this.Context, "ReturnUrl=" + HttpUtility.UrlEncode(Context.Request.Url.AbsoluteUri));
        }
    }