securityTrimmingEnabled

brettemiller · March 21st, 2007, 03:41 PM

I can't seem to get the header menu to respect security trimming. I've created a user without any roles; however both the anonymous user and my new user can see the "Admin" link in the header menu. I would have expected this link to be suppressed.

My config file contains the following:

Code:

<siteMap defaultProvider="TBH_SiteMapProvider" enabled="true">
  <providers>
     <add name="TBH_SiteMapProvider" type="System.Web.XmlSiteMapProvider" securityTrimmingEnabled="true" siteMapFile="Web.sitemap"/>
  </providers>
</siteMap>

And my web.sitemap contains:

Code:

<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" enableLocalization="true">
  <siteMapNode title="Home" url="~/Default.aspx">
    <siteMapNode title="Store" url="~/Store/Default.aspx">
      <siteMapNode title="Shopping cart" url="~/Store/ShoppingCart.aspx" />
    </siteMapNode>
    <siteMapNode title="Forum" url="~/Forum/Default.aspx" />
    <siteMapNode title="About" url="~/About.aspx" />
    <siteMapNode title="Contact" url="~/Contact.aspx" />
    <siteMapNode title="Admin" url="~/Admin/Default.aspx" roles="Administrators" />
  </siteMapNode>
</siteMap>

My masterpage.master contains:

Code:

<asp:SiteMapDataSource StartingNodeOffset="0" ID="SiteMapDataSource1"  runat="server" />
<asp:Menu ID="mnuHeader" runat="server" CssClass="headermenulink"  DataSourceID="SiteMapDataSource1" Orientation="Horizontal" MaximumDynamicDisplayLevels="0" SkipLinkText="" StaticDisplayLevels="2" />

Is there something obvious I am missing?

Many thanks.

Brett Miller

brettemiller · March 22nd, 2007, 07:38 AM

Ugh. I needed the web.config file for the admin folder. Alternatively, one can add the following block to the top-level config file:

Code:

<location path="Admin">
  <system.web>
    <authorization>
      <allow roles="Administrators" />
      <deny users="*"/>
    </authorization>
  </system.web>
</location>

Brett Miller