SiteMap based on user roles doesn't work

I have sitemap which looks like this:

    <?xml version="1.0" encoding="utf-8" ?>

<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
   <siteMapNode url="~/default.aspx" title="Prva stran" 开发者_运维百科roles="*"  description="Shema ISEF">    
        <siteMapNode roles="2" title="Analize" id="Analize"  description="" >
             <siteMapNode url="~/karneki1.aspx" title="Karneki1"  description="" />
             <siteMapNode url="~/karneki2.aspx" title="Karneki2"  description="" />    
        </siteMapNode>
    </siteMapNode>
</siteMap>

if I set roles in a siteMapNode with title "Analiza" it works fine, the link is not shown in the navigation... but if I set roles on any of "karneki" siteMapNode the links are still visible...

Is it even posible to restrict access to lower links based on user role?

Use the SiteMap 'securityTrimmingEnabled' attribute:

http://msdn.microsoft.com/en-us/library/ms178428.aspx

The asecurityTrimmingEnabled attribute also needs to be added to the nodes in the markup:

http://weblogs.asp.net/jgalloway/archive/2008/01/26/asp-net-menu-and-sitemap-security-trimming-plus-a-trick-for-when-your-menu-and-security-don-t-match-up.aspx

An overview of how securityTrimmingEnabled is supposed to work:

http://blogs.msdn.com/b/dannychen/archive/2006/03/16/553005.aspx

The solution to this is that you need to set the roles in a Web.config for the pages itself.

See http://weblogs.asp.net/jgalloway/archive/2008/01/26/asp-net-menu-and-sitemap-security-trimming-plus-a-trick-for-when-your-menu-and-security-don-t-match-up.aspx

e.g. in the folder for a page called AdminOnly.aspx add a Web.Config with the following:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
  <location path="AdminOnly.aspx">
    <system.web>
      <authorization>
        <allow roles="Administrator"/>
        <deny users="*" />
      </authorization>
    </system.web>
  </location>
</configuration>

Try to add the roles to the site map like this

<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
  <siteMapNode url="~/default.aspx" roles="*" title="Prva stran" roles="*"  description="Shema ISEF">
    <siteMapNode roles="2" title="Analize" id="Analize"  description="" >
      <siteMapNode roles="*" url="~/karneki1.aspx" title="Karneki1"  description="" />
      <siteMapNode roles="*" url="~/karneki2.aspx" title="Karneki2"  description="" />
    </siteMapNode>
  </siteMapNode>
</siteMap>