ASP.NET web.sitemap - roles do not seem to control visibility?

Question

I have a (simple) sitemap and am trying to figure out why a certain sub-menu is always visible.

<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
  <siteMapNode url="~/Login.aspx" title="Home" description="RivWorks" roles="*">
    <siteMapNode url="" title="Dashboard" description="" roles="campaigns, auto_negotiation">
      <siteMapNode url="CampaignBuilder.aspx" title="Campaign Manager" description="Manage your campaign settings" roles="campaigns" />
      <siteMapNode url="ProductManager.aspx" title="Negotiation Manager" description="Manage your product and negotiation settings" roles="auto_negotiation" />
    </siteMapNode>
    <siteMapNode url="" title="Support Options" description="" roles="customers, customer_super, riv_admins, riv_super">
      <siteMapNode url="ChangePassword.aspx" title="Change Password" description="" roles="customers, customer_super, riv_admins, riv_super" />
      <siteMapNode url="http://rivworks.zendesk.com/requests/anonymous/new" title="Submit a Support Ticket" description="" roles="customers, customer_super, riv_admins, riv_super" />
      <siteMapNode url="http://rivworks.zendesk.com/forums/49919/entries" title="Tips &amp; Tricks" description="" roles="customers, customer_super, riv_admins, riv_super" />
    </siteMapNode>
  </siteMapNode>
</siteMap>

---

NOTE: WEB.CONFIG SETTINGS

<siteMap defaultProvider="XmlSiteMapProvider" enabled="true">
  <providers>
    <add name="XmlSiteMapProvider"
         description="Default Site Map Provider"
         type="System.Web.XmlSiteMapProvider"
         siteMapFile="Web.sitemap"
         securityTrimmingEnabled="true" />
  </providers>
</siteMap>

---

I have a main menu option of "Dashboard". Under this menu item I have 2 options: 1) Campaign Manager & 2) Negotiation Manager. Now, what is interesting is when I am in either the campaigns role OR the auto-negotiation role I see the Dashboard and BOTH sub-menu items. This is not the behavior I expected. I expect to only see both sub-menus when I am in the campaigns role AND auto-negotiation role. The OR scenario should give me the Dashboard menu item and one OR the other sub-item...

Am I doing something wrong here or thinking a wrong way?

TIA

Answer 1

I suspect you've fallen into the trap we all do, in beieving that the roles attribute restricts visibility of the nodes. It doesn't, it actually widens visibility. All restrictions are done with the standard section in web.config.

See http://blogs.ipona.com/davids/archive/2009/01/12/8554.aspx for more.