linkdemand for principalpermission

28 Sep 2005 2:36 AM

Jas

I can't seem to understand what a linkdemand for a principalpermission means?
If linkdemands are satisfied at JIT phase, how can it figure out the current
principal before running the code?

For example, if I was going to use windowsprincipals to make RBS decisions,
and I decorate a method with a linkdemand for principalpermission of
"BUILTIN\ADMINISTARTORS" like this:

[PrincipalPermissionAttribute(SecurityAction.LinkDemand, Role =
@"BUILTIN\Administrators")]
static void MethodA()

how would the JIT figure this out without running the code? When I runthe
above code, it always produces "SecurityException: Request for principal
permission failed....". And it looks that is happening at JIT phase not
runtime. This becomes even more of an issue when I'm using generic roles.

Am I missing something?

7 Oct 2005 1:39 PM

Nicole Calinoiu

"Jas" <J**@discussions.microsoft.com> wrote in message
news:14C94F27-6A8A-4A9B-A826-048517566E73@microsoft.com...
>I can't seem to understand what a linkdemand for a principalpermission
>means?

Pretty much nothing.

> If linkdemands are satisfied at JIT phase, how can it figure out the
> current
> principal before running the code?

It can't.

Show quoteHide quote

> For example, if I was going to use windowsprincipals to make RBS
> decisions,
> and I decorate a method with a linkdemand for principalpermission of
> "BUILTIN\ADMINISTARTORS" like this:
>
> [PrincipalPermissionAttribute(SecurityAction.LinkDemand, Role =
> @"BUILTIN\Administrators")]
> static void MethodA()
>
>
> how would the JIT figure this out without running the code? When I runthe
> above code, it always produces "SecurityException: Request for principal
> permission failed....". And it looks that is happening at JIT phase not
> runtime. This becomes even more of an issue when I'm using generic roles.
>
> Am I missing something?

You should be using SecurityAction.Demand, not SecuirtyAction.LinkDemand, in
your PrincipalPermission attributes (and, for other reasons, most other
permission request attributes with the occasional exception of identity
permissions). PrincipalPermission does not inherit from
CodeAccessPermission, and it does not perform a stack walk, so there's
essentially no point in even trying the link demand approach anyway (even if
it did work <g>).

7 Oct 2005 5:51 PM

Jas

Nicole,

Thanks, that's what I thought but I wanted to be sure.

Show quoteHide quote

"Jas" wrote:

> I can't seem to understand what a linkdemand for a principalpermission means?
> If linkdemands are satisfied at JIT phase, how can it figure out the current
> principal before running the code?
>
> For example, if I was going to use windowsprincipals to make RBS decisions,
> and I decorate a method with a linkdemand for principalpermission of
> "BUILTIN\ADMINISTARTORS" like this:
>
> [PrincipalPermissionAttribute(SecurityAction.LinkDemand, Role =
> @"BUILTIN\Administrators")]
> static void MethodA()
>
>
> how would the JIT figure this out without running the code? When I runthe
> above code, it always produces "SecurityException: Request for principal
> permission failed....". And it looks that is happening at JIT phase not
> runtime. This becomes even more of an issue when I'm using generic roles.
>
> Am I missing something?