<p>I'm using the <a href="http://msdn.microsoft.com/en-us/library/ms178329.aspx" rel="nofollow noreferrer">ASP.NET Login Controls</a> and <a href="http://msdn.microsoft.com/en-us/library/aa480476.aspx" rel="nofollow noreferrer">Forms Authentication</a> for membership/credentials for an ASP.NET web application.  And I'm using a <a href="http://msdn.microsoft.com/en-us/library/yy2ykkab.aspx" rel="nofollow noreferrer">site map</a> for site navigation.</p>

<p>I have ASP.NET TreeView and Menu navigation controls populated using a SiteMapDataSource.  But off-limits administrator-only pages are visible to non-administrator users.</p>

<hr>

<blockquote>
  <p><strong><a href="https://stackoverflow.com/users/1574/kevin-pang">Kevin Pang</a></strong> wrote:</p>
  
  <p>I'm not sure how this question is any
  different than your <a href="https://stackoverflow.com/questions/33263/how-do-i-best-handle-role-based-permissions-using-forms-authentication-on-my-as">other question</a>&hellip;</p>
</blockquote>

<p>The other question deals with assigning and maintaining permissions.</p>

<p>This question just deals with presentation of navigation.  Specifically TreeView and Menu controls with sitemap data sources.</p>

<pre><code>&lt;asp:Menu ID="Menu1" runat="server" DataSourceID="SiteMapDataSource1" /&gt;
&lt;asp:SiteMapDataSource ID="SiteMapDataSource1" runat="server" ShowStartingNode="False" /&gt;
</code></pre>

<hr>

<blockquote>
  <p><strong><a href="https://stackoverflow.com/users/2808/nicholas">Nicholas</a></strong> wrote:</p>
  
  <p>add role="SomeRole" in the sitemap</p>
</blockquote>

<p>Does that only handle the display issue?  Or are such page permissions enforced?</p>

[{'answer_id': 33402, 'author': 'Vin', 'author_id': 1747, 'author_profile': 'https://Stackoverflow.com/users/1747', 'pm_score': 0, 'selected': False, 'text': '<p>I think Jeff Atwood talked about this in the <a href="http://herdingcode.com/?p=36" rel="nofollow noreferrer">Herding Code podcast</a>, when he was questioned about the exact same thing. Listen to it towards the last 15-20 minutes or so.</p>\n\n<p>I think in SO, the datacontext is created in the Controller class. Not sure about a lot of details here. But that\'s what it looked like.</p>\n'}, {'answer_id': 33405, 'author': 'ljs', 'author_id': 3394, 'author_profile': 'https://Stackoverflow.com/users/3394', 'pm_score': 4, 'selected': True, 'text': '<p>You pretty much need to keep the same data context available throughout the lifetime of the operations you want to perform if you\'re ever going to be storing changes which are to be <code>.SubmitChanges()</code>\'d later, as otherwise you will lose those changes.</p>\n\n<p>If you\'re just querying stuff then it\'s fine to create them as needed, but then if later you want to <code>.SubmitChanges()</code> you\'ll have to refactor your code a lot, so you may as well adopt the pattern of effectively keeping the <code>datacontext</code> global throughout your app from the beginning.</p>\n\n<p>Note the data context is <em>disconnected</em>. The connection is only made when the query data is <em>enumerated</em> (not when you first run the query, it\'s a \'lazy\' data type so only provides data when it\'s needed), and then closed immediately afterwards. On <code>.SubmitChanges()</code> the connection is opened to submit the changes then closed immediately afterwards. So don\'t think keeping the <code>datacontext</code> around keeps a connection open, it doesn\'t (you can hook the <code>StateChange</code> event of the connection to confirm this for yourself, that\'s how I\'m sure).</p>\n\n<p>There is a great article over at <a href="http://www.west-wind.com/weblog/posts/246222.aspx" rel="nofollow noreferrer">Rick Strahl\'s Blog</a> which covers this topic in depth, far more than my answer here provides!!</p>\n'}]
['https://Stackoverflow.com/questions/33395', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/83/']