views:

3428

answers:

2

I have a web.sitemap with security trimming enabled, however I need to hide a menu item based on a role to a page that has no access rules in the web.config.

i.e I have a Campaign page that is used to view existing campaigns as well as to add new campaigns, but I want the "New Campaigns" menu item to be hidden for anonymous users. I tried adding the role name to the roles attribute in the web.sitemap but this has no effect.

I'm sure there must be a quick way to do this without modifying the sitemap provider which is my next port of call.

+1  A: 

The roles attribute in a <siteMapNode /> is an "allow" list, not a deny. Create/modify a corresponding <location /> element in web.config to allow authenticated users and deny anonymous; e.g.

<location path="campaigns.aspx">
 <system.web>
  <authorization>
   <allow users="*" />
   <deny users="?" />
  </authorization>
 </system.web>
</location>

BTW, if you're using a Windows principal and roles, any changes to your group membership don't take effect until you log off and then back on.

devstuff
This won't work because the same page is used to view Campaigns by anonymous users. Therefore I need to be able to simply hide the menu item without actually locking it down, in this instance the Page handles the different security states.
Nicholas
+1  A: 

If this is just a special case for anonymous users, you could create a second SiteMap.

Create a new file WebAnon.sitemap.
Create a new sitemap provider in the web.config

<add name="anonProvider" type="System.Web.XmlSiteMapProvider" siteMapFile="WebAnon.sitemap" securityTrimmingEnabled="true"/>

Set the SiteMapDataSource's SiteMapProvider property to "anonProvider" in the code behind if its an anonymous user.

Greg
I was hoping that there was a way to do it "out the box", but looks like I'm gonna have to create a new sitemap provider.
Nicholas