Hide authorized menu item in asp.net web.sitemap

Question

I have a web.sitemap with security trimming enabled, however I need to hide a menu item based on a role to a page that has no access rules in the web.config.

i.e I have a Campaign page that is used to view existing campaigns as well as to add new campaigns, but I want the "New Campaigns" menu item to be hidden for anonymous users. I tried adding the role name to the roles attribute in the web.sitemap but this has no effect.

I'm sure there must be a quick way to do this without modifying the sitemap provider which is my next port of call.

Answer 1

The roles attribute in a <siteMapNode /> is an "allow" list, not a deny. Create/modify a corresponding <location /> element in web.config to allow authenticated users and deny anonymous; e.g.

<location path="campaigns.aspx">
 <system.web>
  <authorization>
   <allow users="*" />
   <deny users="?" />
  </authorization>
 </system.web>
</location>

BTW, if you're using a Windows principal and roles, any changes to your group membership don't take effect until you log off and then back on.

Answer 2

If this is just a special case for anonymous users, you could create a second SiteMap.

Create a new file WebAnon.sitemap.
Create a new sitemap provider in the web.config

<add name="anonProvider" type="System.Web.XmlSiteMapProvider" siteMapFile="WebAnon.sitemap" securityTrimmingEnabled="true"/>

Set the SiteMapDataSource's SiteMapProvider property to "anonProvider" in the code behind if its an anonymous user.