Tag: sercurity

For SharePoint applications, some times we have to create ASP.NET Application pages that reside under the _layouts folder and are not managed by SharePoint Security system.

We have to secure them manually by code, one way is to check in Page_Load and disable controls if necessary.

protected void Page_Load(object sender, EventArgs e)
        {
            if (!UserIsAuthorized)
            {
                //hide the form
                //show an error message
            }
}

Make sure to check if user is authorized in critical methods.

To check if user is authorized:

protected UserIsAuthorized
{
   get
  {
      SPUser  user = SPContext.Current.Web.CurrentUser;

     if(user==null) return false;//anonymous/public users

     //check if user belongs to authorized groups
            string[] validGroups = new string[] { “Group A”, “Group B };
            SPGroupCollection groups = user.Groups;
            foreach (SPGroup group in groups)
                if (validGroups.Contains(group.Name))
                    return true;

    //check if user is System Account
    if (user.ID == SPContext.Current.Web.Site.SystemAccount.ID)
                return true;

    return false;//user is not authorized;
   }
}