Prevent Access to Custom Web Application Pages by Non-Admin Users

Question

I have a custom web application that integrates with a SharePoint (MOSS 2007) solution. I would like to add role-based access to pages in this custom web application, with only users in a specified SharePoint group or with a specific role being able to access them. Other users being sent to the default OOTB web page, giving the message "You Are Not Authorized to View This Page".

Can anyone point me towards tutorials on how to implement this, and how to control access on each custom page?

Please note, these pages are part of the custom web application, and are NOT created via the SharePoint API or interface.

Answer 1

You can write a simple function to call the web services at /_vti_bin/usergroup.asmx and using the GetUserCollectionFromGroup method to get a collection back of the given users for the specified group. Then you would just have to grab the current user's info and see if they are in the list.

Answer 2

A nice way to do this is to implement a custom ASP.NET RoleProvider which runs in the context of your custom web app.

Assuming the custom web app runs on the same servers as the SharePoint web app, you can then use the SharePoint Object Model in your Role Provider implementation to test SharePoint group membership. If your SharePoint web app does not run on the same server as your custom web app, you should be able to consume the web services provided out-of-the-box by SharePoint to test for SharePoint group membership.