One of the most interesting and truly useful features of the new XmlSiteMapProvider is it's ability to selectively generate HTML through it's "securityTrimmingEnabled" attribute. A common requirement for many web sites is to allow only certain users to access certain parts of the site. ASP.NET 2.0's new role management features provides an easy way to restrict access to web pages based on security roles. The SiteMapProvider model offers security trimming to provide a way to hide navigational links in a site map, also based on security roles. All that's required is to set the "securityTrimmingEnabled" attribute to "true" and the SiteMapProvider will do the rest of the work.

In my application I've setup an "Admin" folder under the main web site, which contains Administrator only web pages to allow the Administrator to add users, shipping addresses, etc. Since I don't want normal users to access this section of the web site I created a Web.config in the Admin folder as shown below. This blocks all site users except those belonging to the "Admin" role from accessing any files in this folder.

With the XmlSiteMapProvider's "securityTrimmingEnabled" set to true a user assigned to the "Admin role sees this menu.

While a normal user sees this menu.

What's very cool about this is that the SiteMapProvider doesn't just "hide" the trimmed parts of the menu. The HTML is not even generated by the control making it much more difficult for a "normal" user to even know that the "Admin" section of the site exists! You can set a breakpoint in your page code and run in "Debug" mode to see exactly how this works. It's a pretty cool little feature that saves countless hours of programming.