Hi,

i have a problem with the visibility of the sitemap.
there is one role defined: manager
There are two users: user1 (member of role manager) and user2 (not member).
The login.aspx redirects to a page with a menu control associated to a SiteMapDataSource.

I want to hide pg1 for all non-members of role manager (=user2).

I did this in:

web.sitemap:
------------
<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
   <siteMapNode url="page1.aspx" title="pg1" roles="manager" >
        <siteMapNode url="page2.aspx" title="pg2" >
        </siteMapNode>
        <siteMapNode url="page3.aspx" title="pg3" >
           </siteMapNode>
      </siteMapNode>
</siteMap>

in web.config:
------------
  <roleManager enabled="true" />

  <siteMap defaultProvider="AspXmlSiteMapProvider" enabled="true">
        <providers>
          <clear/>
          <add name="AspXmlSiteMapProvider" type="System.Web.XmlSiteMapProvider, System.Web, Version=2.0.3600.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
            siteMapFile="web.sitemap" securityTrimmingEnabled="true"/>
        </providers>
      </siteMap>

My problem: when logging with any user, that user (user2) sees all the pages, included pg1.

How to make pg1 invisible for user2 using this sitemap?
Thanks
Hertendreef

Hi,

I am having exactly the same problem. Inspite of two users having separate role, (and web.sitemap clearly defines two separate items), after login, both the users get same menu.

While other menu items work fine as per role.

Hi there,

You may be misunderstanding the use of the roles attribute in the sitemap. It's used to *extend* the items beyond the roles you're in, not limit it. That is, it allows you to show items to users to which they normally don't have access.

Instead, add a <location> tag to your web.config with its path set to the file you want to protect. Then change the security settings to the correct roles.

For example:

<location path="SomeFile.aspx">
    <system.web>
     <authorization>
        <allow roles="Managers, Administrators" />
        <deny users="*"/>
     </authorization>
    </system.web>
</location>

Hope this helps.

Imar

---------------------------------------
Imar Spaanjaars
http://Imar.Spaanjaars.Com
Everyone is unique, except for me.
Author of ASP.NET 2.0 Instant Results and Beginning Dreamweaver MX / MX 2004