[RESOLVED] Dynamic changes to treeview based on Sitemap

[LuckyJack]

Hi.
I have a web app with treeview based on a fairly simple sitemap. The only catch is that I want to be able to remove nodes based on a user's role. We are NOT using the asp.net security so I can't take advantage of the built-in function.
When I put code in the master page load event (or anywhere else it seems), there seems to be nothing in the treeview object yet, so I can't make changes to it.
Any idea what I need to do, or what I'm doing wrong?
Thanks!

[gep13]

Hello LuckyJack,

Is it possible that you can show the code that you are currently using? Are you creating the TreeView nodes on the fly, or how are these being generated?

Is there a reason that you are not using the ASP.Net Security that comes out of the box?

Gary

[LuckyJack]

Hi, Gary,
Well, there isn't much to show - we're using a web.sitemap file, and we're not using asp.net security because we're using a much simpler security scheme using Windows security (since the app is in-house). Our master page has a treeview based on a Sitemap data source.
In the page-load of the master page, we want to remove nodes of the treeview based on the user's role, like this:

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
 
        If usr.isInRole(Role.ADMIN) = False Then
            Treeview1.Nodes(0).ChildNodes.RemoveAt(4)
        End If

    End Sub

The code above does not work because the Treeview does not seem to be populated - the node count is zero. I tried putting the code in different events of the master page - to no avail.
I've kind of found a way around the difficulty, using a custom Sitemap - but if there is an easier way, please let me know, as the custom sitemap seems a bit of overkill.
Thanks!

[gep13]

Hello,

As far as I am aware, there is nothing to stop you using SecurityTrimming on the TreeView when you are using Windows Authentication. Have you tried it?

Also, have you stepped in the above code? Does this line:

Treeview1.Nodes(0).ChildNodes.RemoveAt(4)

Ever get hit?

Are you saying that if you remove the above code that the TreeView does get populated? Are you binding the TreeView in the ASPX markup?

Gary

[LuckyJack]

Hi.
The code gets hit - and when it hits, the treeview appears to have no nodes so the code fails (I can't recall the error - index out of bounds?). The treeview gets populated fine when the code is commented out. I've tried placing the code in different form events - and the treeview always shows 0 nodes. Re; using security trimming - I thought that would only work with the asp.net security provider. Our app authenticates merely by grabbing the windows id of the user, and checking against our own user tables. So our 'roles' are internal to the application only - not part of the Windows OS or any security provider. If there is an easy way to use security trimming with such a setup, that would be great to know.
Paul

[gep13]

Hello,

Can you list the events that you tried it in?

Looking at the documentation for the TreeView there is no "DataBound" event, which would be the natural place to do the work. This is probably due to the fact that the TreeView can be configured to fetch TreeNodes on demand.

It might be better to remove the nodes from the underlying DataSource, rather than removing them from the TreeView.

Ah, I see, in which case yes, SecurityTrimming will not work. What was the design decision to do it this way? Seems like a lot of overhead?!?

Gary

[LuckyJack]

Hi,
I tried it in the load and databound of the form and the treeview, as well as the treenodepopulate. A couple other places as well. In all cases the treeview was either empty or had only one node.
HOWEVER, I seem to have solved the issue. I created a custom sitemap provider. It was pretty simple. And as part of the custom provider, I added the ability to pass the user object in and it will build the sitemap based on the user's roles.
Since I've got this working I'm going to go with it.
Thanks for your help!
Paul

0
Public Class SiteMapProv
    Inherits StaticSiteMapProvider

    Private _root As SiteMapNode
    Private _adminNode As SiteMapNode
    Private _usr As User
    Private _userLoadTS As DateTime

    Protected Overrides Function GetRootNodeCore() As System.Web.SiteMapNode
        Return _root
    End Function

    Public Overrides Function BuildSiteMap() As System.Web.SiteMapNode
        SyncLock Me

            'If the user object has been reloaded, or if it's a different user, then reload the sitemap.
            If _userLoadTS = _usr.loadTS Then
                Return _root
            End If

            Me.Clear()

            _userLoadTS = _usr.loadTS

            'Create a root node
            _root = New SiteMapNode(Me, Pages.HOME_PAGE, "Home.aspx", "Application Home")

            AddNode(_root)

            If _usr.isAuthorized Then

                AddNode(New SiteMapNode(Me, Pages.BILL_CODE_MAINT, "BillCodeMaintenance.aspx", "Bill Code Maintenance"), _root)
                AddNode(New SiteMapNode(Me, Pages.GRP_TYP_MAINT, "GroupTypeMaintenance.aspx", "Group Type Maintenance"), _root)
                AddNode(New SiteMapNode(Me, Pages.GRP_UPDT, "GroupSearchUpdate.aspx", "Group Search Update"), _root)
                AddNode(New SiteMapNode(Me, Pages.MASTER_GRP_SEARCH, "MasterGroupSearch.aspx", "Master Group Search"), _root)

                If _usr.isInRole(Role.ADMIN) Then
                    _adminNode = New SiteMapNode(Me, "Admin", "", "Admin")
                    AddNode(_adminNode, _root)
                    AddNode(New SiteMapNode(Me, Pages.ADD_USER, "Admin/AddUser.aspx", "Add User"), _adminNode)
                    AddNode(New SiteMapNode(Me, Pages.MOD_USER, "Admin/ModifyUser.aspx", "Modify User"), _adminNode)
                End If
            End If

            Return _root
        End SyncLock
    End Function
    Public Property user() As User
        Get
            Return _usr
        End Get
        Set(ByVal value As User)
            _usr = value
        End Set
    End Property

End Class

[gep13]

Hello LuckyJack,

Yip, that looks like a good approach! Thanks for sharing your code!

Gary