Re: User.IsInRole with * wildcard, web.sitemap etc.

You don't specify any authorization requirements in web.sitemap!!!

You use the <authorization> element in web.config for that - the sitemap just uses this information - and the role attribute in the sitemap file allows to override the information found in the authorization element for visual presentation.


-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

hi,
User.IsInRole method appears not to work with the web.sitemap * 'all
roles'
wildcard. is this by design? do i have to handle wildcards manually?
ideally User.IsInRole("*") would return true if the user is in any
role. an
example is below to illustrate.
i have a sitemap node like so:
<siteMapNode title="Report xyz" description="etc"
url="Reports.aspx?sp=XYZ"
roles="*">
since i'm using the querystring to specify a sproc, i make sure to
verify that the user is allowed to access it, as defined in
web.sitemap. so i have code in Reports.aspx that goes like:

foreach (string role in siteMapNode.Roles)
if (User.IsInRole(role))
return; // OK
thanks for any help
tim


.

Relevant Pages

  • Re: Authorization based on roles or directory access?
    ... It would be fine if the <authorization> setting was only checked as an ... security check for nodes that I in the sitemap decided to show. ... to users in "Members" role. ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: Sitemap trimming with Forms auth (Active Directory)
    ... Sitemap will pick up these settings. ... The roles attribute in web.sitemap is ONLY for overriding the settings made in <authorization> ... Dim ticket As FormsAuthenticationTicket = ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: Authorization based on roles or directory access?
    ... Your authorization sections in the web.config file can specify a script ... But the roles attribute in the sitemap works for this authorization ... "For navigation node ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: newbie: asp.net 2.0 security question
    ... With the current settings unathenticated users cannot view the ... more sitemap nodes ...
    (microsoft.public.dotnet.framework.aspnet)
  • Re: User.IsInRole with * wildcard, web.sitemap etc.
    ... my scenario is fairly non-standard, i would accept that, although my reports page is invaluable: it dynamically generates UI controls to match parameters for any SP, and then binds the results to an enhanced GridView with built-in excel export etc.. ... User.IsInRole with * wildcard, ... You use the <authorization> element in web.config for that - the sitemap just uses this information - and the role attribute in the sitemap file allows to override the information found in the authorization element for visual presentation. ... since i'm using the querystring to specify a sproc, ...
    (microsoft.public.dotnet.framework.aspnet.security)