User.IsInRole with * wildcard, web.sitemap etc.

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Tim Mackey - 09 Jul 2007 18:20 GMT

hi,
User.IsInRole method appears not to work with the web.sitemap * 'all roles'
wildcard. is this by design? do i have to handle wildcards manually?
ideally User.IsInRole("*") would return true if the user is in any role. an
example is below to illustrate.

i have a sitemap node like so:
<siteMapNode title="Report xyz" description="etc" url="Reports.aspx?sp=XYZ"
roles="*">

since i'm using the querystring to specify a sproc, i make sure to verify
that the user is allowed to access it, as defined in web.sitemap. so i have
code in Reports.aspx that goes like:

foreach (string role in siteMapNode.Roles)
if (User.IsInRole(role))
return; // OK

thanks for any help
tim

Reply to this Message

Alexey Smirnov - 09 Jul 2007 20:58 GMT

> hi,
> User.IsInRole method appears not to work with the web.sitemap * 'all roles'
[quoted text clipped - 16 lines]
> thanks for any help
> tim

Tim, it makes no sense to worry about (*). If you have roles="*" then
you don't need to check anything, because any role is ok.

Reply to this Message

Dominick Baier - 09 Jul 2007 21:21 GMT

You don't specify any authorization requirements in web.sitemap!!!

You use the <authorization> element in web.config for that - the sitemap
just uses this information - and the role attribute in the sitemap file allows
to override the information found in the authorization element for visual
presentation.

-----
Dominick Baier (http://www.leastprivilege.com)

Developing More Secure Microsoft ASP.NET 2.0 Applications (http://www.microsoft.com/mspress/books/9989.asp)

> hi,
> User.IsInRole method appears not to work with the web.sitemap * 'all
[quoted text clipped - 16 lines]
> thanks for any help
> ti

Reply to this Message

Tim Mackey - 10 Jul 2007 11:51 GMT

alexey, dominick, thanks for the reply. perhaps i should clarify.
authorization is already controlled via web.config in as much as possible.
the 'reports.aspx' page is accessible to anyone, as defined in web.config,
however since i am using querystring parameters to refer to stored
procedures, i perform an additional security check to verify the user's
access to the querystring supplied. Since i have fully specified the access
rules in web.sitemap, i am using the roles defined here to decide if the
user should be able to access a certain URL. the example below illustrates:

<sitemapnode Url="reports.aspx?sp=PublicReport1" Roles="*" />
<sitemapnode Url="reports.aspx?sp=PrivateReport1" Roles="Admins" />
<sitemapnode Url="reports.aspx?sp=PrivateReport2" Roles="Admins" />

reports.aspx currently enumerates the roles specified in web.sitemap to
validate the request. i guess i will have to handle the * wildcard role
manually. my scenario is fairly non-standard, i would accept that, although
my reports page is invaluable: it dynamically generates UI controls to match
parameters for any SP, and then binds the results to an enhanced GridView
with built-in excel export etc. (or sends the parameters to a specified
crystal report).

thanks
tim

----- Original Message -----
From: "Dominick Baier" <dbaier@pleasepleasenospam_leastprivilege.com>
Newsgroups: microsoft.public.dotnet.framework.aspnet.security
Sent: Monday, July 09, 2007 9:21 PM
Subject: Re: User.IsInRole with * wildcard, web.sitemap etc.

> You don't specify any authorization requirements in web.sitemap!!!
>
[quoted text clipped - 29 lines]
>> thanks for any help
>> tim

Reply to this Message

Alexey Smirnov - 10 Jul 2007 12:56 GMT

> alexey, dominick, thanks for the reply. perhaps i should clarify.
> authorization is already controlled via web.config in as much as possible.
[quoted text clipped - 16 lines]
> with built-in excel export etc. (or sends the parameters to a specified
> crystal report).

foreach (string role in siteMapNode.Roles)
if (role == "*" || User.IsInRole(role))
return; // OK

Reply to this Message

User.IsInRole with * wildcard, web.sitemap etc.

Free Magazines