roles based menu does not work, what am I doing wrong?

Question

I can't figure this one out.

• I have the following SiteMap

  <?xml version="1.0" encoding="utf-8" ?>
  
  <siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
      <siteMapNode url="~/" title="Root"  description="Go root">
        <siteMapNode url="~/h" title="Home"  description="Go home" />
  
        <siteMapNode url="~/h/uo" title="Ultima Online" description="Ultima Online">        
          <siteMapNode url="~/h/uo/get" roles="RegisteredUser" title="Get account!" description="Get account!" />
        </siteMapNode>
      </siteMapNode>
  </siteMap>
  

  • I've an XmlSiteMapProvider with securityTrimmingEnabled="true", which points to this site map file.

  • The file I want to trim has an authorization rule in it's folder's web.config

    <configuration>
      <system.web>
        <authorization>
          <deny users="?" />
        </authorization>
      </system.web>
    </configuration>
    

  • The file can't be accessed via url, if I type http://localhost/h/uo/get I get redirected to login page.

  • I've set up an <asp:Menu> like this in the Master page file:

    <asp:SiteMapDataSource ID="MenuSiteMap" ShowStartingNode="false"
                           SiteMapProvider="MenuSiteMapProvider" runat="server" 
    />
    
    <div>
        <asp:Menu ID="NavigationMenu" runat="server" DataSourceID="MenuSiteMap" 
                  CssClass="menu" EnableViewState="false" 
                  IncludeStyleBlock="false" Orientation="Horizontal"
        />
    </div>
    

Yet, when the page is rendered, I see the Get account node that is supposed to be trimmed when I'm not even logged in, no matter what.

• What am I doing wrong?
• Is there any other way to build a security trimming enabled site map navigation menu?

I'm using ASP.NET 4.0, and URL-rewritting with an HttpModule.

Answer 1

In reading http://forums.asp.net/t/975077.aspx/1 I found out that this is exactly what is happening to me.

If the node doesn't have an URL it behaves fine, but if it does, like all of my nodes do. Security trimming is just ignored.

I resolved my problem by resorting to a more intuitive role based site map implementation, to say:

public class TrimmingXmlSiteMapProvider : XmlSiteMapProvider
{
    public override bool IsAccessibleToUser(HttpContext context, SiteMapNode node)
    {
        if (node.Roles.Cast<string>().Any(r => r == "*"))
            return true;

        if (node.Roles.Count > 0 && node.Roles.Cast<string>().Count(Roles.IsUserInRole) == 0)
            return false;

        return node.ParentNode != null && node.ParentNode.IsAccessibleToUser(context);
    }
}

Then, the only change I had to make was add an asterisk to the root level's role definition.

How does this work?

First I check if any of the roles definied for this node is an asterisk, if that's the case, then I can see the node.

Second, if the node isn't everyone-level, I check if there are any roles specified, and if the logged in user is part of at least one of them.

Lastly, I check if there is a parent node, and just inherit their rule.

This allows the security trimming to actually be "SECURITY TRIMMING" and not well, however the heck it's supposed to be working by default.