SiteMap based on user roles doesn't works

Question

I have sitemap which looks like this:

    <?xml version="1.0" encoding="utf-8" ?>

<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
   <siteMapNode url="~/default.aspx" title="Prva stran" roles="*"  description="Shema ISEF">    
        <siteMapNode roles="2" title="Analize" id="Analize"  description="" >
             <siteMapNode url="~/karneki1.aspx" title="Karneki1"  description="" />
             <siteMapNode url="~/karneki2.aspx" title="Karneki2"  description="" />    
        </siteMapNode>
    </siteMapNode>
</siteMap>

if I set roles in a siteMapNode with title "Analiza" it works fine, the link is not shown in the navigation... but if I set roles on any of "karneki" siteMapNode the links are still visible...

Is it even posible to restrict access to lower links based on user role?

Answer 1

Use the SiteMap 'securityTrimmingEnabled' attribute:

http://msdn.microsoft.com/en-us/library/ms178428.aspx

The asecurityTrimmingEnabled attribute also needs to be added to the nodes in the markup:

http://weblogs.asp.net/jgalloway/archive/2008/01/26/asp-net-menu-and-sitemap-security-trimming-plus-a-trick-for-when-your-menu-and-security-don-t-match-up.aspx

An overview of how securityTrimmingEnabled is supposed to work:

http://blogs.msdn.com/b/dannychen/archive/2006/03/16/553005.aspx