I have replicated this in a simple app, which is completely included. I'm sure that there's something that I'm not getting that is preventing it from working correctly.
The web.sitemap is as follows:
<?xml version="1.0" encoding="utf-8" ?>
<siteMap xmlns="http://schemas.microsoft.com/AspNet/SiteMap-File-1.0" >
<siteMapNode url="Default.aspx" title="Home" description="Home page" roles="*">
<siteMapNode url="AnonPage.aspx" title="Anon" description="Anon" roles="*" />
<siteMapNode url="UserPage.aspx" title="User" description="User" roles="Users" />
<siteMapNode url="AdminPage.aspx" title="Admin" description="Admin" roles="Admin" />
</siteMapNode>
</siteMap>
so there is a home page, an anon page, a page for logged in users and one for admins.
The master page contains a menu to show the sitemap, as follows:
<%@ Master Language="C#" AutoEventWireup="true" CodeFile="MasterPage.master.cs" Inherits="MasterPage" %>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" >
<head runat="server">
<title>Untitled Page</title>
</head>
<body>
<form id="form1" runat="server">
<div>
<asp:Menu ID="Menu1" runat="server" DataSourceID="SiteMapDataSource1">
</asp:Menu>
<br />
<br />
<asp:SiteMapDataSource ID="SiteMapDataSource1" runat="server" />
<asp:contentplaceholder id="ContentPlaceHolder1" runat="server">
</asp:contentplaceholder>
</div>
</form>
</body>
</html>
The actual pages are all just stubs, like this:
<%@ Page Language="C#" MasterPageFile="~/MasterPage.master" AutoEventWireup="true" CodeFile="Default.aspx.cs" Inherits="_Default" Title="Untitled Page" %>
<asp:Content ID="Content1" ContentPlaceHolderID="ContentPlaceHolder1" Runat="Server">
Default page
</asp:Content>
The web.config is as follows, with securityTrimmingEnabled:
<?xml version="1.0"?>
<configuration>
<appSettings/>
<connectionStrings/>
<system.web>
<compilation debug="true"/>
<authentication mode="Forms"/>
<siteMap defaultProvider="XmlSiteMapProvider" enabled="true">
<providers>
<add name="XmlSiteMapProvider"
description="Default SiteMap provider."
type="System.Web.XmlSiteMapProvider"
siteMapFile="web.Sitemap"
securityTrimmingEnabled="true" />
</providers>
</siteMap>
</system.web>
</configuration>
Now when I run it, the menu shows all four items. I expected the non-anon ones to be trimmed off, since I am not in any roles. In fact there are no roles, or a database. but no trimming happens. Why am I seeing admin pages in the menu when I am not logged in?
I've had some luck adding in authorisation into web.config:
i.e.
<configuration>
...
system.web>
<authorization>
<deny users="?" />
</authorization>
and
<configuration>
...
<location path="default.aspx">
<system.web>
<authorization>
<allow users ="*" />
</authorization>
</system.web>
</location>
<location path="anonpage.aspx">
<system.web>
<authorization>
<allow users ="*" />
</authorization>
</system.web>
</location>
And menu trimming happens. However, this is ignoring the roles specified in the web.sitemap file, which is defeating the point.