Home All Groups Group Topic Archive Search About

SecurityExcepion inside DLL linked in an HTML tag OBJECT

Author
11 Sep 2006 1:01 PM
Lambuz
Hi there,
I've got this strange problem.

I've created a library of some assemblies and one of these
(webclient.dll) is linked inside an html tag object by using this
sintax:

<OBJECT id="myID" classid="http:WebClient.dll#namespace.WebClientClass"
/>

The assembly is correctly loaded inside IE, in fact if a try to invoke
a sample methods I've got back the correct return value.

The problem is that this assembly must use some remoting object.

All remoting confs are inside a config file put in the same virtual
directory of assembly and html file.

I always obtain an exception when I try to use this code:

RemotingConfiguration.Configure("CPRSWebClient.config");

The exception is the following:

System.Security.SecurityException: Request for the permission of type
'System.Security.Permissions.SecurityPermission, mscorlib,
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089'
failed.
at System.Runtime.Remoting.RemotingConfiguration.Configure(String
filename)
at IBM.Cipros.Refinery.CPRSWebClient.Check()
The action that failed was: Demand The type of the first permission
that failed was: System.Security.Permissions.SecurityPermission
The Zone of the assembly that failed was: Trusted

Anyone can help me ?

Author
11 Sep 2006 7:47 PM
Spam Catcher
"Lambuz" <lamb***@gmail.com> wrote in news:1157979697.949475.153030
@h48g2000cwc.googlegroups.com:

> Hi there,
> I've got this strange problem.
>
> I've created a library of some assemblies and one of these
> (webclient.dll) is linked inside an html tag object by using this
> sintax:
>
> <OBJECT id="myID" classid="http:WebClient.dll#namespace.WebClientClass"
> />

You need full trust to make this setup work :(
Author
12 Sep 2006 4:59 AM
Joe Kaplan
This is not necessarily true.  It is true that you need to understand CAS to
make this work and may need to elevate the CAS permissions of this assembly
to have the permissions required.  There are various approaches available to
doing this that don't necessarily involve full trust (although that is
easiest).  Shawn Farkas has written a bunch of blog postings describing how
to do this properly.  Here is one:

http://blogs.msdn.com/shawnfa/archive/2003/06/26/57026.aspx

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
Show quoteHide quote
"Spam Catcher" <spamhoneypot@rogers.com> wrote in message
news:Xns983BA079A29C6usenethoneypotrogers@127.0.0.1...
> "Lambuz" <lamb***@gmail.com> wrote in news:1157979697.949475.153030
> @h48g2000cwc.googlegroups.com:
>
>> Hi there,
>> I've got this strange problem.
>>
>> I've created a library of some assemblies and one of these
>> (webclient.dll) is linked inside an html tag object by using this
>> sintax:
>>
>> <OBJECT id="myID" classid="http:WebClient.dll#namespace.WebClientClass"
>> />
>
> You need full trust to make this setup work :(
Author
12 Sep 2006 4:36 AM
Dominick Baier
well - for remoting he really needs full trust...

---
Dominick Baier, DevelopMentor
http://www.leastprivilege.com

Show quoteHide quote
> This is not necessarily true.  It is true that you need to understand
> CAS to make this work and may need to elevate the CAS permissions of
> this assembly to have the permissions required.  There are various
> approaches available to doing this that don't necessarily involve full
> trust (although that is easiest).  Shawn Farkas has written a bunch of
> blog postings describing how to do this properly.  Here is one:
>
> http://blogs.msdn.com/shawnfa/archive/2003/06/26/57026.aspx
>
> Joe K.
>
Author
12 Sep 2006 9:37 AM
Lambuz
Anyone can explain to me how I can do it ?

I've given full trust permissione to my assembly using .NET
Configuration 1.1 panel but I obtain the same SecurityException...why ?

I'm using a strong name with my assembly and for giving full trust
permission I've tried to ways:
- In runtime security policy\Machine\Code Groups\LocalIntranet_Zone
I've added a new Code Group for my assembly and I've assigned to it the
Full Trust permission set
- I've used the Wizard "Trust an assembly"

Please help me
Author
12 Sep 2006 2:21 PM
Joe Kaplan
Did you read the article from Shawn Farkas?  It explains this problem.
Essentially, your DLL may have full trust, but the app domain does not.
Thus, you either need to Assert all of the required permissions inside your
code to suppress the stack walk, or you need to ensure that the app domain
IE creates gets full trust via a URL membership condition.  Shawn explains
it in more detail.

Joe K.

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
Show quoteHide quote
"Lambuz" <lamb***@gmail.com> wrote in message
news:1158053866.826310.141140@h48g2000cwc.googlegroups.com...
> Anyone can explain to me how I can do it ?
>
> I've given full trust permissione to my assembly using .NET
> Configuration 1.1 panel but I obtain the same SecurityException...why ?
>
> I'm using a strong name with my assembly and for giving full trust
> permission I've tried to ways:
> - In runtime security policy\Machine\Code Groups\LocalIntranet_Zone
> I've added a new Code Group for my assembly and I've assigned to it the
> Full Trust permission set
> - I've used the Wizard "Trust an assembly"
>
> Please help me
>
Author
12 Sep 2006 2:21 PM
Joe Kaplan
Doh! Missed the remoting part.  :)

Thanks!

--
Joe Kaplan-MS MVP Directory Services Programming
Co-author of "The .NET Developer's Guide to Directory Services Programming"
http://www.directoryprogramming.net
--
Show quoteHide quote
"Dominick Baier" <dbaier@pleasepleasenospam_leastprivilege.com> wrote in
message news:4580be63135ae8c8a44ce1cf7290@news.microsoft.com...
> well - for remoting he really needs full trust...
>
> ---
> Dominick Baier, DevelopMentor
> http://www.leastprivilege.com
>
>> This is not necessarily true.  It is true that you need to understand
>> CAS to make this work and may need to elevate the CAS permissions of
>> this assembly to have the permissions required.  There are various
>> approaches available to doing this that don't necessarily involve full
>> trust (although that is easiest).  Shawn Farkas has written a bunch of
>> blog postings describing how to do this properly.  Here is one:
>>
>> http://blogs.msdn.com/shawnfa/archive/2003/06/26/57026.aspx
>>
>> Joe K.
>>
>
>
Author
12 Sep 2006 9:41 AM
Lambuz
> You need full trust to make this setup work :(

can you explain to me how I can do it ?

I've given full trust permissione to my assembly using .NET
Configuration 1.1 panel but I obtain the same SecurityException...why ?



I'm using a strong name with my assembly and for giving full trust
permission I've tried to ways:
- In runtime security policy\Machine\Code Groups\LocalIntranet_Zone
I've added a new Code Group for my assembly and I've assigned to it the

Full Trust permission set
- I've used the Wizard "Trust an assembly"


Please help me
Author
12 Sep 2006 9:42 AM
Lambuz
> You need full trust to make this setup work :(

Can you explain to me how I can do it ?

I've given full trust permissione to my assembly using .NET
Configuration 1.1 panel but I obtain the same SecurityException...why ?



I'm using a strong name with my assembly and for giving full trust
permission I've tried to ways:
- In runtime security policy\Machine\Code Groups\LocalIntranet_Zone
I've added a new Code Group for my assembly and I've assigned to it the

Full Trust permission set
- I've used the Wizard "Trust an assembly"


Please help me
Author
12 Sep 2006 5:06 PM
Spam Catcher
"Lambuz" <lamb***@gmail.com> wrote in news:1158054167.505613.173800
@e63g2000cwd.googlegroups.com:

>
>> You need full trust to make this setup work :(
>
> Can you explain to me how I can do it ?
>
> I've given full trust permissione to my assembly using .NET
> Configuration 1.1 panel but I obtain the same SecurityException...why ?
>


Try this.

Start the .NET 1.1 Configuration Panel
Create a new Code Group (i.e. MyApp)
Set security to "Site"
Set the URL to your site (i.e. http://MySite/myApp)
Set security to full trust.

Shut down IE.
Start IE.
Goto site.
Try applet.

Does that work?

BTW, check out CASPOL - you can create security settings from the command
line - good for deployment/setup apps :)
Author
19 Sep 2006 2:18 PM
Lambuz
I can't solve this problem in no way, so I've changed how configure
remoting on client side.

Before I used configuration file, but RemotingConfiguration.Configure
method doesn't support URI string for file location and my
configuration file is available on a web site, the same site of
assembly.

Now I'm trying to use code configuration for remoting but I've got
another problem.

At the first C# istruction TcpClientChannel _channel = new
TcpClientChannel(); the IE gives me the following error:

that assembly does not allow partially trusted callers

The problem is that my assembly is strong named and I'm using the
istruction [assembly:AllowPartiallyTrustedCallers()].

How can I solve this new problem ?
Author
19 Sep 2006 2:18 PM
Lambuz
I can't solve this problem in no way, so I've changed how configure
remoting on client side.

Before I used configuration file, but RemotingConfiguration.Configure
method doesn't support URI string for file location and my
configuration file is available on a web site, the same site of
assembly.

Now I'm trying to use code configuration for remoting but I've got
another problem.

At the first C# istruction TcpClientChannel _channel = new
TcpClientChannel(); the IE gives me the following error:

that assembly does not allow partially trusted callers

The problem is that my assembly is strong named and I'm using the
istruction [assembly:AllowPartiallyTrustedCallers()].

How can I solve this new problem ?
Author
19 Sep 2006 2:18 PM
Lambuz
I can't solve this problem in no way, so I've changed how configure
remoting on client side.

Before I used configuration file, but RemotingConfiguration.Configure
method doesn't support URI string for file location and my
configuration file is available on a web site, the same site of
assembly.

Now I'm trying to use code configuration for remoting but I've got
another problem.

At the first C# istruction TcpClientChannel _channel = new
TcpClientChannel(); the IE gives me the following error:

that assembly does not allow partially trusted callers

The problem is that my assembly is strong named and I'm using the
istruction [assembly:AllowPartiallyTrustedCallers()].

How can I solve this new problem ?
Author
12 Sep 2006 9:47 AM
Lambuz
> You need full trust to make this setup work :(

Can you explain to me how I can do it ?

I've given full trust permissione to my assembly using .NET
Configuration 1.1 panel but I obtain the same SecurityException...why ?



I'm using a strong name with my assembly and for giving full trust
permission I've tried to ways:
- In runtime security policy\Machine\Code Groups\LocalIntranet_Zone
I've added a new Code Group for my assembly and I've assigned to it the

Full Trust permission set
- I've used the Wizard "Trust an assembly"


Please help me