Hi,
i have a custom SiteMapProvider
which I populate from a database. I also have a custom SiteMapNode
which has to be constructed with a custom Page
argument.
The implementation of SiteMapProvider.IsAccessibleToUser(context, node)
is now:
Public Overrides Function IsAccessibleToUser(context, node) As Boolean
Return CType(node, CustomSiteMapNode).Page.IsAccessibleToUser(context.User)
End Function
I also have a custom authentication class-attribute
:
Public Class ValidateAuthorization : Inherits AuthorizeAttribute
Public Sub New()
End Sub
Protected Overrides Function AuthorizeCore(context) As Boolean
If Not CType(SiteMap.CurrentNode, JrcSiteMapNode).Page.IsAccessibleToUser(httpContext.User) Then
Throw New ApplicationException()
End If
Return True
End Function
End Class
Two questions:
- Should I return false in AuthorizeCore() to have everything work according to default authorization protocols? (What are these?) Or should I throw my exception..?
- SiteMap.CurrentNode is Null / Nothing (in AuthorizeCore()) if the page which is requested is not accessible to the user (obviously). How should I change my implementation? I want to keep the functionality that the
Page
objects are only loaded once, so I need to store them somewhere... I'm very confused / mental blocking.