Re: can someone explain me why this does not work?

I thought this would be a challenge for some 'expert' guys ..
But i found it finally ...
page1 is parent of the others, so the others are also hidden.
thanks.


"Chris" <cc@xxxxx> schreef in bericht
news:uslqE%232sHHA.1776@xxxxxxxxxxxxxxxxxxxxxxx
Hi,

I have a problem with sitemap combined with role. I posted in the
professional group but i reformulated here and made the things simplier: I
tried a lot of things, read a lot of stuff, but it's still unsolved.

there are two defined users: user1 and user2
there is one role: manager
user1 belongs to the role manager; user2 not.

there are three pages (page1.aspx, page2.aspx and page3.aspx).
page1.aspx is only reserved for role manager (user1)
page2.aspx and page3.aspx is for all users.

the sitemap is:
-------------
<siteMapNode url="page1.aspx" title="pg1" roles="manager" >
<siteMapNode url="page2.aspx" title="pg2" roles="*" >
</siteMapNode>
<siteMapNode url="page3.aspx" title="pg3" roles="*" >
</siteMapNode>
</siteMapNode>

i read somewhere on internet this:
"If the current user is in a role specified in the node's Roles property,
or if Roles is "*", the node is returned. "
"If the current user is not in a role specified in the node's Roles
property, then a URL authorization check is performed to determine whether
the user has access to the node's URL. If the answer is yes, the node is
returned. "

so i put a URL authorization in the web.config:
-----------------------------------------------------------------

<configuration
xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0";>
<appSettings/>
<connectionStrings/>

<system.web>
<roleManager enabled="true" />
</system.web>

<location path="page1.aspx">
<system.web>
<authorization>
<deny users="*" />
</authorization>
</system.web>
</location>

<system.web>

<compilation debug="false" strict="false" explicit="true" />
<pages>
<namespaces>
<clear />
<add namespace="System" />
.......
.........
</namespaces>
</pages>

<authentication mode="Forms" />

<siteMap defaultProvider="AspXmlSiteMapProvider" enabled="true">
<providers>
<clear/>
<add name="AspXmlSiteMapProvider"
type="System.Web.XmlSiteMapProvider, System.Web, Version=2.0.3600.0,

Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"
siteMapFile="web.sitemap" securityTrimmingEnabled="true"/>
</providers>
</siteMap>
</system.web>
</configuration>

When logging as user1, i see the three pages (that's ok).
When logging with user2, i see nothing.

Because user2 is not in the role for page1, the Url authorization takes
place and this page1 is hidden, but why the two others? there are
roles="*" on each line in web.sitemap.

Later,I added this in web.config for testing: but this gives exactly the
same: user1 sees all 3 pages, user2 nothing!

<location path="page2.aspx">
<system.web>
<authorization>
<allow users="*" />
</authorization>
</system.web>
</location>

Thanks for explanation
Chris



.

Relevant Pages

  • can someone explain me why this does not work?
    ... user1 belongs to the role manager; user2 not. ... then a URL authorization check is performed to determine whether ...
    (microsoft.public.dotnet.framework.aspnet)
  • problem with sitemap and roles
    ... user1 belongs to the role manager; user2 not. ... then a URL authorization check is performed to determine whether the user ...
    (microsoft.public.dotnet.framework.aspnet)
  • RE: dirty reada to committed read
    ... page then user1 is locking the whole page therefore user2 get a lock error ... I have tried setting Isolation Level to Dirty Read, ... The only isolation level that has an impact on updates and deletes is ...
    (comp.databases.informix)
  • Re: Versioning control
    ... User2 has removed a function from file3 which is used by file1. ... User1 has tested all of his changes and all of them work well. ... User1 commits all of changes. ... "1.2 What is CVS not? ...
    (Debian-User)
  • Re: Versioning control
    ... User2 has removed a function from file3 which is used by file1. ... User1 has tested all of his changes and all of them work well. ... User1 commits all of changes. ... Use a policy that you have to pull changes before commit and thus each user can ...
    (Debian-User)