The securityTrimmingEnabled="true" in web.config works too good - asp.net

Question

I'm using C# ASP.NET 4 VS2010.
I'm using membership with roles, which are already defined as usual.
I have a ~/web.sitemap file that includes this:
(The ~/ security is Allow to all.)
<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
<siteMapNode url="" title="" description="">
<siteMapNode url="" title="A menu for the Administrator" description="">
<siteMapNode url="~/Admin/ResetPassword.aspx" title="Reset password for a user" description="" />
<siteMapNode url="~/Admin/SendEmailToUser.aspx" title="Send e-mail to a user" description="" />
</siteMapNode>
<siteMapNode url="" title="A menu for the SIC (second in command) person" description="">
<siteMapNode url="~/SIC/UnlockUser.aspx" title="Unlock a user" description="" />
<siteMapNode url="~/SIC/ApproveUser.aspx" title="Approve a user" description="" />
</siteMapNode>
<siteMapNode url="" title="A menu for users" description="">
<siteMapNode url="~/Users/MakeYourContribute.aspx" title="Make your contribution" description="" />
<siteMapNode url="~/Users/CheckOnYourBalance.aspx" title="Check on your balance" description="" />
</siteMapNode>
<siteMapNode url="" title="A menu for anonymous visitors" description="">
<siteMapNode url="~/AboutUs.aspx" title="About us" description="" />
<siteMapNode url="~/Application.aspx" title="Send an application to join us" description="" />
</siteMapNode>
</siteMapNode>
</siteMap>
and a web.config file that ends like this:
<siteMap defaultProvider="XmlSiteMapProvider" enabled ="true">
<providers>
<add name="XmlSiteMapProvider" type="System.Web.XmlSiteMapProvider" siteMapFile="~/web.sitemap" securityTrimmingEnabled="true" />
</providers>
</siteMap>
</system.web>
</configuration>
My menu is based on the asp:Repeater control and looks like this:
<div>
<ul>
<li>
<asp:hyperlink runat="server" id="lnkHome" navigateurl="~/Default.aspx">Home</asp:hyperlink>
</li>
<asp:repeater runat="server" id="menu" datasourceid="SiteMapDataSource1">
<ItemTemplate>
<li>
<asp:HyperLink ID="lnkMenuItem" runat="server" NavigateUrl='<%# Eval("Url") %>'><%# Eval("Title") %></asp:HyperLink>
<asp:Repeater ID="submenu" runat="server" DataSource="<%# ((SiteMapNode) Container.DataItem).ChildNodes %>">
<HeaderTemplate>
<ul>
</HeaderTemplate>
<ItemTemplate>
<li>
<asp:HyperLink ID="lnkMenuItem" runat="server" NavigateUrl='<%# Eval("Url") %>'><%# Eval("Title") %></asp:HyperLink>
</li>
</ItemTemplate>
<FooterTemplate>
</ul>
</FooterTemplate> </asp:Repeater> </li> </ItemTemplate> </asp:Repeater> </ul>
<asp:sitemapdatasource id="SiteMapDataSource1" runat="server" showstartingnode="true" />
</div>
The security of allow/deny to folders is defined for the respective folders.
There are 4 levels of security: 1) Administrators. 2)Second In Command (SIC). 3) Users (all registered users). 4) Anonymous users.
For example, both the members of the Administrators role and the SIC role are allowed on the operate in the folder ~/SIC , but the rest of the users are restricted from it.
Now, as soon as I added the securityTrimmingEnabled="true" to the web.config, the only row I see on the menu is Home.
Have I configured anything wrong?
Are there any more configuration I need to make in order to have this security dependent menu work?

Answer 1

The problem is the empty URL in the menu headers.
<siteMapNode url="" title="A menu for the Administrator" description="">
It appears that the sitemap functionality is trying to determine the permissions for the empty url "", and failing.
A workaround is to modify the .sitemap file to explicitly state the roles that can access the parent nodes.
<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
<siteMapNode url="" title="" description="" roles="*">
<siteMapNode url="" title="A menu for the Administrator" description="" roles="Administrators">
<siteMapNode url="~/Admin/ResetPassword.aspx" title="Reset password for a user" description="" />
<siteMapNode url="~/Admin/SendEmailToUser.aspx" title="Send e-mail to a user" description="" />
</siteMapNode>
<siteMapNode url="" title="A menu for the SIC (second in command) person" description="" roles="administrators,second in command">
<siteMapNode url="~/SIC/UnlockUser.aspx" title="Unlock a user" description="" />
<siteMapNode url="~/SIC/ApproveUser.aspx" title="Approve a user" description="" />
</siteMapNode>
<siteMapNode url="" title="A menu for users" description="" roles="administrators,secondincommand,users">
<siteMapNode url="~/Users/MakeYourContribute.aspx" title="Make your contribution" description="" />
<siteMapNode url="~/Users/CheckOnYourBalance.aspx" title="Check on your balance" description="" />
</siteMapNode>
<siteMapNode url="" title="A menu for anonymous visitors" description="" roles="*">
<siteMapNode url="~/AboutUs.aspx" title="About us" description="" />
<siteMapNode url="~/Application.aspx" title="Send an application to join us" description="" />
</siteMapNode>
</siteMapNode>
</siteMap>
Admittedly, this isn't ideal, because now you are partially configuring security in two places.
Another option is to just put roles="*" on every menu header. It will still apply the permissions check on every leaf node and hide them if necessary. The downside to this is that it can then display empty menu headers.
Here is the resource which pointed me to this solution: https://web.archive.org/web/20210417091658/http://www.4guysfromrolla.com/articles/122805-1.aspx