HttpModule events - sharepoint interception redirected to accessdenied.aspx

Question

For my installation of SharePoint, I have a specific user group that does not have access to the main page of the site. If they visit it directly, they get the standard "Access Denied" page from SharePoint.

I am developing an HttpModule that intercepts a visit on the main page, validates the current user and redirects it to a sub-site to which they have access.

At first I tried using PostAuthorizeRequest , but it looks like the SharePoint triggers in an earlier event and are still being redirected to the Access Denied page. I tested with a user who had access to the main page, but was redirected, and there the redirect worked fine.

What event is required for capture in order to be able to get the user after they enter the username / password, but before SharePoint redirects them?

Answer 1

Instead of catching an “unauthorized” event in your code, I suggest you go with user errors. When a user is redirected to the Access denied page, SharePoint actually generates an error with error code "401" (for unauthorized access).

In your web.config, you can customize the behavior of your application for 401 errors. If you have ever made a custom error page in a web application, this is the same. Take a look at the CustomError node in your web.config and change it to something like this:

 <customErrors mode="On" defaultRedirect="~/_layouts/CustomErrorPage.aspx"> <error statusCode="401" redirect="~/_layouts/AccessDeniedPage.aspx" /> </customErrors> 

Then create your CustomErrorPage.aspx and your AccessDeniedPage.aspx and deploy them in 12 bushes.

In the data code of these pages, you can override the PageLoad event to redirect them to where you want:

 protected void Page_Load(object sender, EventArgs e) { bool isLogged = HttpContext.Current.User.Identity.IsAuthenticated; Response.Redirect("wherever"); } 

Please note that at this point you will still have access to the SPContext object if you need it (and I assume that you will want to write specific code depending on the membership in the user group).

This is not a specific SharePoint behavior. All ASP.NET applications work that way. Using a configuration at the whole site level will allow you to run your code only when it needs to be executed (i.e. when access is denied) instead of checking permissions for each page load or something like that.

Answer 2

As in SharePoint 2013, we have an error to configure the page for refusing user access, it is explained here how to implement it using the HTTPModule.

Create HTTPModule Step Wise - explained using the CustomAccessDenied page in SharePoint 2013