I have a set of application pages stored in the _layouts virtual directory, that I'd like to secure, in order to prevent **unauthorized access** to the pages, as well as **prevent** certain **actions** from being **executed**.

My authorization structure consists of several **AD Security Groups** (although this is somewhat *flexible*, and I could create the groups in SharePoint), each of which, will have a set of application pages that they can access, and actions within each page that the user can execute. Something along these lines:

    User Group | Access to Application Pages | Actions
    -----------+-----------------------------+-----------------------------------------
    A          | Page1.aspx, Page2.aspx      | Page1.aspx->Button1, Page2.aspx->Button2
    -----------+-----------------------------+-----------------------------------------
    B          | Page1.aspx                  | Page1.aspx->Button3
    -----------+-----------------------------+----------------------------------------- 

An [article][1] on MSDN, suggests using `SPRoleDefinition`s, and verify at `Page_PreLoad`, for example, if a user has the required roles to access the page, and if not, redirect him to `accessdenied.aspx`. The same could be done for the actions within each page. However, this solution would require me to drop AD Groups, and store users and groups in SharePoint.

Another solution would be to add `location` tags to the `web.config` with `allow` and `deny`, although this solution doesn't solve the problem of preventing actions within each page from being executed.

      <location path="_layouts/Page1.aspx">
        <system.web>
          <authorization>
            <allow roles="AD\A,AD\B" />

**How** can this type of scenario be accomplished? **What** is the typical configuration used in SharePoint solutions for this use case? 

  [1]: http://msdn.microsoft.com/en-us/library/dd878359%28v=office.12%29.aspx