ASP.NET is great technology. My wife has been recently studying programming (at home) and of all .NET technologies, she liked ASP.NET the most. When I asked her why, she said “almost everything works automatically - I don't have to write any code”. She is right, but the high level nature of ASP.NET can also be a real headache.

While helping my wife with her first real project I stumbled upon the following issue: if you have a sitemap as an XML file (web.sitemap) pay close attention to the nodes that are just used for grouping(in other words, these nodes are not clickable and don't link to any page). For example, the structure might look like this:

Home page
Normal pages
  Page 1
  ...
Admin pages
  Page 42
  ...

If your site map provider has securityTrimmingEnabled on then all of the grouping nodes will be filtered out along with their child nodes. This means that in the above case the nodes and all child nodes of both Normal pages node and Admin pages node will be missing.

The fix is to set roles attribute manually on these nodes to match the roles that are supposed to be allowed to access these nodes (the reason why you originally set the trimming on). It is somewhat duplicate of what you already set in the web.config for the authorization, but needs to be done.