Question

I’m using MVC sitemap for MVC3 but having problems with it.
Consider the following sitemap file:

<?xml version="1.0" encoding="utf-8" ?>
<mvcSiteMap xmlns="http://mvcsitemap.codeplex.com/schemas/MvcSiteMap-File-3.0" enableLocalization="true">
  <mvcSiteMapNode title="Home" controller="Home" action="Index" changeFrequency="Always" updatePriority="Normal" Description="Test HOME">
    <mvcSiteMapNode title="Today" controller="Dashboard" action="Today" />
    <mvcSiteMapNode title="Today1" controller="Dashboard" action="Today1" />
    <mvcSiteMapNode title="Today2" controller="Dashboard" action="Today2" />
    <mvcSiteMapNode title="Today3" controller="Dashboard" action="Today3" />
    <mvcSiteMapNode title="Today4" controller="Dashboard" action="Today4" />   
  </mvcSiteMapNode>
</mvcSiteMap>

When I load my web page up I only get the following options:

Today1, Today2, Today3, Today4

But Today is not displayed. This is an action on a controller whereas the other actions don’t exist. Why is it hiding the item which actually exists on the controller? I took off authorization on the controller to rule out it had anything to do with authorization but still same effect.

This is the sitemap config (set in web.config):

  <siteMap defaultProvider="MvcSiteMapProvider" enabled="true">
      <providers>
        <clear />
        <add name="MvcSiteMapProvider" 
             type="MvcSiteMapProvider.DefaultSiteMapProvider, MvcSiteMapProvider" 
             siteMapFile="~/Mvc.Sitemap" 
             securityTrimmingEnabled="true" 
             cacheDuration="5" 
             enableLocalization="true"
             scanAssembliesForSiteMapNodes="false" 
             includeAssembliesForScan="" 
             excludeAssembliesForScan="" 
             attributesToIgnore="visibility" 
             nodeKeyGenerator="MvcSiteMapProvider.DefaultNodeKeyGenerator, MvcSiteMapProvider" 
             controllerTypeResolver="MvcSiteMapProvider.DefaultControllerTypeResolver, MvcSiteMapProvider" 
             actionMethodParameterResolver="MvcSiteMapProvider.DefaultActionMethodParameterResolver, MvcSiteMapProvider" 
             aclModule="MvcSiteMapProvider.DefaultAclModule, MvcSiteMapProvider" 
             siteMapNodeUrlResolver="MvcSiteMapProvider.DefaultSiteMapNodeUrlResolver, MvcSiteMapProvider" 
             siteMapNodeVisibilityProvider="MvcSiteMapProvider.DefaultSiteMapNodeVisibilityProvider, MvcSiteMapProvider" 
             siteMapProviderEventHandler="MvcSiteMapProvider.DefaultSiteMapProviderEventHandler, MvcSiteMapProvider" />
      </providers>      
    </siteMap>
  </system.web>

Answer 1

I find out the problem.
The HttpContext user’s InRole() method is used in the MvcSiteMapProvider.DefaultAclModule within the library code.
I am using Forms Authentication which means the InRole will never work as the roles property on the user context is not set (it doesn’t know how roles are applied).

I could either write my own aclmodule provider which checks the authentication ticket for the roles stored within the ticket, or alternatively for every authentication request event in global.asax, set the context with the roles set. In the end I chose the latter:

e.g.

  if (HttpContext.Current.User != null)
        {
            if (HttpContext.Current.User.Identity.IsAuthenticated)
            {
                if (HttpContext.Current.User.Identity is FormsIdentity)
                {                     
                    FormsIdentity formsId = (FormsIdentity)HttpContext.Current.User.Identity;
                    FormsAuthenticationTicket ticket = formsId.Ticket;

                    // need to do this so MVC sitemap IsInRole works inside default acl module: MvcSiteMapProvider.DefaultAclModule
                    var authData = new AuthenticationModel(ticket.UserData);
                    var roles = new List<string>(authData.EffectiveRoles).ToArray();
                    HttpContext.Current.User = new GenericPrincipal(formsId, roles);
                }
            }
        }