Printable View
Hi.
I have a web app with treeview based on a fairly simple sitemap. The only catch is that I want to be able to remove nodes based on a user's role. We are NOT using the asp.net security so I can't take advantage of the built-in function.
When I put code in the master page load event (or anywhere else it seems), there seems to be nothing in the treeview object yet, so I can't make changes to it.
Any idea what I need to do, or what I'm doing wrong?
Thanks!
Hello LuckyJack,
Is it possible that you can show the code that you are currently using? Are you creating the TreeView nodes on the fly, or how are these being generated?
Is there a reason that you are not using the ASP.Net Security that comes out of the box?
Gary
Hi, Gary,
Well, there isn't much to show - we're using a web.sitemap file, and we're not using asp.net security because we're using a much simpler security scheme using Windows security (since the app is in-house). Our master page has a treeview based on a Sitemap data source.
In the page-load of the master page, we want to remove nodes of the treeview based on the user's role, like this:
The code above does not work because the Treeview does not seem to be populated - the node count is zero. I tried putting the code in different events of the master page - to no avail.Code:Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
If usr.isInRole(Role.ADMIN) = False Then
Treeview1.Nodes(0).ChildNodes.RemoveAt(4)
End If
End Sub
I've kind of found a way around the difficulty, using a custom Sitemap - but if there is an easier way, please let me know, as the custom sitemap seems a bit of overkill.
Thanks!
Hello,
As far as I am aware, there is nothing to stop you using SecurityTrimming on the TreeView when you are using Windows Authentication. Have you tried it?
Also, have you stepped in the above code? Does this line:
Ever get hit?Code:Treeview1.Nodes(0).ChildNodes.RemoveAt(4)
Are you saying that if you remove the above code that the TreeView does get populated? Are you binding the TreeView in the ASPX markup?
Gary
Hi.
The code gets hit - and when it hits, the treeview appears to have no nodes so the code fails (I can't recall the error - index out of bounds?). The treeview gets populated fine when the code is commented out. I've tried placing the code in different form events - and the treeview always shows 0 nodes. Re; using security trimming - I thought that would only work with the asp.net security provider. Our app authenticates merely by grabbing the windows id of the user, and checking against our own user tables. So our 'roles' are internal to the application only - not part of the Windows OS or any security provider. If there is an easy way to use security trimming with such a setup, that would be great to know.
Paul
Hello,
Can you list the events that you tried it in?
Looking at the documentation for the TreeView there is no "DataBound" event, which would be the natural place to do the work. This is probably due to the fact that the TreeView can be configured to fetch TreeNodes on demand.
It might be better to remove the nodes from the underlying DataSource, rather than removing them from the TreeView.
Ah, I see, in which case yes, SecurityTrimming will not work. What was the design decision to do it this way? Seems like a lot of overhead?!?
Gary
Hi,
I tried it in the load and databound of the form and the treeview, as well as the treenodepopulate. A couple other places as well. In all cases the treeview was either empty or had only one node.
HOWEVER, I seem to have solved the issue. I created a custom sitemap provider. It was pretty simple. And as part of the custom provider, I added the ability to pass the user object in and it will build the sitemap based on the user's roles.
Since I've got this working I'm going to go with it.
Thanks for your help!
Paul
Code:0
Public Class SiteMapProv
Inherits StaticSiteMapProvider
Private _root As SiteMapNode
Private _adminNode As SiteMapNode
Private _usr As User
Private _userLoadTS As DateTime
Protected Overrides Function GetRootNodeCore() As System.Web.SiteMapNode
Return _root
End Function
Public Overrides Function BuildSiteMap() As System.Web.SiteMapNode
SyncLock Me
'If the user object has been reloaded, or if it's a different user, then reload the sitemap.
If _userLoadTS = _usr.loadTS Then
Return _root
End If
Me.Clear()
_userLoadTS = _usr.loadTS
'Create a root node
_root = New SiteMapNode(Me, Pages.HOME_PAGE, "Home.aspx", "Application Home")
AddNode(_root)
If _usr.isAuthorized Then
AddNode(New SiteMapNode(Me, Pages.BILL_CODE_MAINT, "BillCodeMaintenance.aspx", "Bill Code Maintenance"), _root)
AddNode(New SiteMapNode(Me, Pages.GRP_TYP_MAINT, "GroupTypeMaintenance.aspx", "Group Type Maintenance"), _root)
AddNode(New SiteMapNode(Me, Pages.GRP_UPDT, "GroupSearchUpdate.aspx", "Group Search Update"), _root)
AddNode(New SiteMapNode(Me, Pages.MASTER_GRP_SEARCH, "MasterGroupSearch.aspx", "Master Group Search"), _root)
If _usr.isInRole(Role.ADMIN) Then
_adminNode = New SiteMapNode(Me, "Admin", "", "Admin")
AddNode(_adminNode, _root)
AddNode(New SiteMapNode(Me, Pages.ADD_USER, "Admin/AddUser.aspx", "Add User"), _adminNode)
AddNode(New SiteMapNode(Me, Pages.MOD_USER, "Admin/ModifyUser.aspx", "Modify User"), _adminNode)
End If
End If
Return _root
End SyncLock
End Function
Public Property user() As User
Get
Return _usr
End Get
Set(ByVal value As User)
_usr = value
End Set
End Property
End Class
Hello LuckyJack,
Yip, that looks like a good approach! Thanks for sharing your code!
Gary