I was recently tasked with creating a menu system that was dynamic depending on the user's security level. For example, a user that was part of an Administrator group would be able to see a menu item for the Administrator pages. User's who were not part of the Administrator group would not be able to see this menu.

So I decided to use the ASP.Net Menu and use an XML Datasource as it's datasource.

So first, you have your ASP.Net Menu....

<asp:Menu ID="Menu1" runat="server" Orientation="Horizontal" DisappearAfter="10"
    Width="300px" DataSourceID="XmlDataSource1" StaticEnableDefaultPopOutImage="False">
    <StaticMenuItemStyle CssClass="MenuItem" />
    <DynamicHoverStyle CssClass="SubMenuItemHover" />
    <DynamicMenuItemStyle CssClass="SubMenuItem" />
    <StaticHoverStyle CssClass="MenuItemHover" />
    <DataBindings>
        <asp:MenuItemBinding DataMember="Item" NavigateUrlField="Url" TextField="Text" />
    </DataBindings>
</asp:Menu>

then we have our XML datasource object...

<asp:XmlDataSource ID="XmlDataSource1" runat="server" />

Notice that the "DataSourceID" of the Menu is set to the XMLDataSource.

Also notice the "DataBindings" attributes. This will determine the Text and URL of the Menu items.

So now we have our XML files....

Administrator file (admin_menu.xml)

<?xml version="1.0" encoding="utf-8" ?>
<Items Text="">
  <Item Text="Home" Url="~/default.aspx"   />
  <Item Text="Time Entry" Url="">
    <Item Text="Time Entry Page" Url="~/TimeEntryPage.aspx" />
  </Item>
  <Item Text="Admin" Url="">
    <Item Text="Move Time Entry"  Url ="~/MoveTimeEntry.aspx" />
  </Item>
</Items>

Normal User file (user_menu.xml)

<?xml version="1.0" encoding="utf-8" ?>
<Items Text="">
  <Item Text="Home" Url="~/default.aspx"   />
  <Item Text="Time Entry" Url="">
    <Item Text="Time Entry Page" Url="~/TimeEntryPage.aspx" />
  </Item>
</Items>

As you can see, the Administrator file has an entry for the "Admin" menu and the Normal User file does not.

Now in the code behind, we will determine if the user is an Administrator or not.

protected void Page_Load(object sender, EventArgs e)
{
    if (!Page.IsPostBack)
    {
        string appDataPath = HttpContext.Current.Server.MapPath("~/App_Data");
        this.XmlDataSource1.DataFile = appDataPath + "\\" + GetRole() + "_menu.xml";
        this.XmlDataSource1.XPath = @"/Items/Item";
    }
}

and the GetRole() method

// This method checks against a database field to determine if user
//     is an Admin
// You could also integrate with Active Directory to see if user
//    is part of a specific AD user group
// The Session "OperatorID" is stored from a login page
protected string GetRole()
{
    string role = string.Empty;
    int operatorID = 0;

    operatorID = int.Parse(Session["OperatorID"].ToString());

    if (OperatorManager.IsOperatorAdmin(operatorID))
        role = "Admin";
    else
        role = "User";

    return role;
}

And that's it.

Now the benefit of this is that you can change the menus that users will see by simply editing the xml files(assuming the .aspx pages are already created). For example, if I wanted all users to see the Admin menu, I would simply change the xml file on the web server. No need to build and publish the site again.