I have a custom roleprovider and xmlsitemapprovider to enable roles through securitytrimming. That works like a charm. However when I use the <authorization> element in my web.config like this:
<location path="~/adminpages/admin.aspx">
<authorization>
<allow roles="Admin" />
<deny user="*" />
</authorization>
</location>
then I am still able to type in the url of the page and navigate to it even when the role is not assigned to me (also not provided as a link due to securitytrimming in my sitemap file).
How to resolve this? I am using custom principal and custom IIdentity implementation. The only thing that does not work for me is the url authorization. How to deal with this and solve this?
...
Go to the complete details ...