Authorization against a user's membership in certain SharePoint groups via HttpModule

Question

I'm trying to restrict access to certain pages of a SharePoint Web Application based upon a user's membership in certain SharePoint groups (restricting access to specific pages and functions, while otherwise granting a user greater rights via SharePoint RoleDefinitions and groups)

I plan to assume that proper groups exist and that appropriate RoleDefinitions are applied to the user's groups, so when a particular page is requested and caught (perhaps on the HttpApplication.AuthorizeRequest event [?]) I am looking to either redirect them to the site/web access denied page, return a simple 401, or something similar, if they are not in a particular SharePoint group.

If I can actually go in and check for particular RoleDefinitions on the user's SharePoint group(s), that would be even better.

Once I get the user's principal (with HttpApplication.Context.User.Identity ??) in the HttpModule, how do I go about checking what Groups (or Roles) they are associated with in SharePoint? Which assemblies, functions, etc would I have to utilize to get this info? Also is this significantly more complicated if they are granted the SharePoint Permissions through an AD group (i.e. Their User is in an AD group, which is a member of a SharePoint Group, which has one or more RoleDefinitions applied)?

There would be a finite number of pages to restrict and a finite number of SharePoint Groups (or possibly RoleDefinitions), but an unknown number of users.

Answer 1

So in short, I checked using GetUserEffectivePermissionInfo() and getting the RoleDefinitionBindings collection of each RoleAssignment, then checking through there for the appropriate RoleDefinition name.

I start by making sure there is a user and a site to check against. I pass the requested URL to the sharepoint API new SPSite(...) - which gives me the site collection - and use OpenWeb() to get the web associated with the URL passed to the SPSite constructor. Passing the user's name to the GetUserEffectivePermissionInfo() function returns a collection of SPRoleAssignments (the "Groups" the user is a member of), each of which has a collection of SPRoleDefinition "bindings" (the "roles" or "permission levels" applied to each "group").

I cycle through all of these and find if they have the correct RoleDefinition (or "Permission Level" in front-end speak).

string reqUrl = application.Request.Url.AbsoluteUri;
string requestingUser = application.Context.User.Identity.Name;
try
{
    if (!String.IsNullOrEmpty(requestingUser)) // first make sure there is a user to check...
    {
        using (var reqSite = new SPSite(reqUrl))
        {
            using (var reqWeb = reqSite.OpenWeb())
            {
                var roleInfoCollection = reqWeb.GetUserEffectivePermissionInfo(requestingUser);
                foreach (var roleAssignment in roleInfoCollection.RoleAssignments)
                {
                    foreach (SPRoleDefinition binding in roleAssignment.RoleDefinitionBindings)
                    {
                        //check if they have the role
                        if (!String.IsNullOrEmpty(roleBeingSearchedFor) &&
                            roleBeingSearchedFor.Equals(binding.Name))
                        {
                            //do something because they have the role being searched for
                        } else {/*if they don't have the role...*/}
                    }
                }
            }
        }
    }
}
catch(......){} //etc...

Hope this helps someone!

Note: application is the httpApplication object passed to the init function of the HttpModule, which I made static to the class during initialization.