or you go fetch a page from your DB (usually bigger than the page that you actually want to display) and then call

BulkCheckPermission

on the IDs that came out of your DB