Permission Denied Error: assembly

Showing posts with label assembly. Show all posts

Wednesday, March 21, 2012

Permissions needed to Create Assembly

Hi,
I am having difficulties in creating an assembly in a user database.
I am using an SQL login that is a db_owner of a database. The assembly has
PERMISSION_SET = EXTERNAL_ACCESS.
The first attempt gave these 2 messages:-
Error 1: Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
Error 2: Msg 300, Level 14, State 1, Line 2
EXTERNAL ACCESS ASSEMBLY permission denied on object 'server', database
'master'.
I then gave External Access Assemblies permission. This took away the 2nd
message but not the
Error 1: Msg 6585, Level 16, State 1, Line 2
Does the SQL Login have to be a sysadmin to do this?
Thanks
Chris
Hello Chris,
In a word, yes. You also need the right rights to read the DLL from the source
location (eg, a DACL for the account that windows is running under IIRC).
If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do the
"Safety Dance" too. See [0] for more information on that.
[0]: http://www.sqljunkies.com/WebLog/kte...ssemblies.aspx
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/
|||Kent,
I forgot to mention that I did alter the user db to set TRUSTWORTHY ON. I
still get the 1st message
Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
BOL talks a lot about the Windows Account. Does this message mean Windows
permissions to the actual DLL?
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74140e08c80fe968b1a9f0@.news.microsoft.co m...
> Hello Chris,
> In a word, yes. You also need the right rights to read the DLL from the
> source location (eg, a DACL for the account that windows is running under
> IIRC).
> If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do
> the "Safety Dance" too. See [0] for more information on that.
> [0]:
> http://www.sqljunkies.com/WebLog/kte...ssemblies.aspx
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
|||Hello Chris,

> Msg 6585, Level 16, State 1, Line 2
> Could not impersonate the client during assembly file operation.
> BOL talks a lot about the Windows Account. Does this message mean
> Windows permissions to the actual DLL?
Yes, that's what that means.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/
|||Kent,
I have the DLL on my workstation. Do I need to have the DLL on the server
and have the authority on the server?
Thanks
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74142918c80ff76b247aa0@.news.microsoft.co m...
> Hello Chris,
>
> Yes, that's what that means.
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>
|||Hello Chris,

> I have the DLL on my workstation. Do I need to have the DLL on the
> server and have the authority on the server?
Well, what you need to have is a way for you to read that file from your
client from the server. I'm guessing at the moment that there's probably
a firewall between you and the server, right? Or can you simply not logon
that Windows Server on which the SQL Server instance is running?
Is there a particular reason you're not using Visual Studio to deploy here?
The reason that I ask is that it issues the create assembly command with
a binary serialization of the assembly, so there's no reason to "read the
file" from your machine. You can see it doing this with SQL profiler.
If nothing else, deploy the assembly to a local SQL Server, then use management
studio to script the assembly out to .SQL file. You could then run that file
on the remote server since the script will have the assembly inline as a
byte stream.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/

Permissions needed to Create Assembly

Hi,
I am having difficulties in creating an assembly in a user database.
I am using an SQL login that is a db_owner of a database. The assembly has
PERMISSION_SET = EXTERNAL_ACCESS.
The first attempt gave these 2 messages:-
Error 1: Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
Error 2: Msg 300, Level 14, State 1, Line 2
EXTERNAL ACCESS ASSEMBLY permission denied on object 'server', database
'master'.
I then gave External Access Assemblies permission. This took away the 2nd
message but not the
Error 1: Msg 6585, Level 16, State 1, Line 2
Does the SQL Login have to be a sysadmin to do this?
Thanks
ChrisHello Chris,
In a word, yes. You also need the right rights to read the DLL from the sour
ce
location (eg, a DACL for the account that windows is running under IIRC).
If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do the
"Safety Dance" too. See [0] for more information on that.
[0]: http://www.sqljunkies.com/WebLog/kt...es
.aspx
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Kent,
I forgot to mention that I did alter the user db to set TRUSTWORTHY ON. I
still get the 1st message
Msg 6585, Level 16, State 1, Line 2
Could not impersonate the client during assembly file operation.
BOL talks a lot about the Windows Account. Does this message mean Windows
permissions to the actual DLL?
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74140e08c80fe968b1a9f0@.news.microsoft.com...
> Hello Chris,
> In a word, yes. You also need the right rights to read the DLL from the
> source location (eg, a DACL for the account that windows is running under
> IIRC).
> If you didn't ALTER DATABASE with SET TRUSTWORTHY on, you'll need to do
> the "Safety Dance" too. See [0] for more information on that.
> [0]:
> http://www.sqljunkies.com/WebLog/kt...op.com/ktegels/
>|||Hello Chris,

> Msg 6585, Level 16, State 1, Line 2
> Could not impersonate the client during assembly file operation.
> BOL talks a lot about the Windows Account. Does this message mean
> Windows permissions to the actual DLL?
Yes, that's what that means.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/|||Kent,
I have the DLL on my workstation. Do I need to have the DLL on the server
and have the authority on the server?
Thanks
Chris
"Kent Tegels" <ktegels@.develop.com> wrote in message
news:b87ad74142918c80ff76b247aa0@.news.microsoft.com...
> Hello Chris,
>
> Yes, that's what that means.
> Thank you,
> Kent Tegels
> DevelopMentor
> http://staff.develop.com/ktegels/
>|||Hello Chris,

> I have the DLL on my workstation. Do I need to have the DLL on the
> server and have the authority on the server?
Well, what you need to have is a way for you to read that file from your
client from the server. I'm guessing at the moment that there's probably
a firewall between you and the server, right? Or can you simply not logon
that Windows Server on which the SQL Server instance is running?
Is there a particular reason you're not using Visual Studio to deploy here?
The reason that I ask is that it issues the create assembly command with
a binary serialization of the assembly, so there's no reason to "read the
file" from your machine. You can see it doing this with SQL profiler.
If nothing else, deploy the assembly to a local SQL Server, then use managem
ent
studio to script the assembly out to .SQL file. You could then run that file
on the remote server since the script will have the assembly inline as a
byte stream.
Thank you,
Kent Tegels
DevelopMentor
http://staff.develop.com/ktegels/

Tuesday, March 20, 2012

Permissions needed to Create Assembly

Friday, March 9, 2012

Permission-problem on simple query inside CLR function

I have created an assembly with permission set safe, and a function inside the assembly.

The function reads data from the same SQL Server as it is running inside. For connection I use the "Context connection = true", and the function has the SystemDataAccessKind attribute set to Read.

However when I execute my CLR function I get an error saying something like:

"The request for permission of type System.Data.SqlClient.SqlClientPermission...... failed"

I do, as the login user, have been granted the necessary rights, so I don't believe this is the answer to the error.

And my .dll is also signed.

Has this something to do with writing something a config file?

I have had simular problems with reporting services but fixed them by entering a node in the rspolicy.config file. If this is the case here - which .config file should i modify...machine.config?

Where do you execute your CLR proc from, i.e. where do you get the exception?

Niels
|||

Inside Management Studio. Management Studio is running on a different machine than the SQL Server, but the user that I use when logging into Management Studio is dbowner, and the same user that I use to create the assembly and CLR function.

If I extract the SQL from the CLR function and runs it as a basic query in Management Studio, everything works fine.

|||

I have also noted than when I try to create an SqlPermission in the code and run the Asset(), I get another type of error:

System.Security.Permissions.SecurityPermissions, mscorlib....

|||What happens if you try to do a "normal" query from the SSMS you are testing from, against a table in a database on the SQL Server you have deployed your assembly to?

Niels
|||

pnp wrote:

Inside Management Studio. Management Studio is running on a different machine than the SQL Server, but the user that I use when logging into Management Studio is dbowner, and the same user that I use to create the assembly and CLR function.

If I extract the SQL from the CLR function and runs it as a basic query in Management Studio, everything works fine.

Oh, sorry - disregard my previous posting anout executing a "normal query", I didn't read your post properly. I assume, when you say that you run it as a basic query, that you are running it from the same SSMS that you fail when going against the CLR proc?

What if you try and run from the same box that SQL is on?

Niels
|||

Niels, thanks for your suggestions. I have also installed Management Studio on the same server that is running the SQL Server but the error is the same.

However, as I don't have endless time to deal with this problem I have fixed it by setting the permission of the assembly to unsafe. This fixes it. However, from the documentation I have read, safe-permissions should be enough, and I don't really understand why it isn't in my case.

Permission-problem on simple query inside CLR function

I have created an assembly with permission set safe, and a function inside the assembly.

The function reads data from the same SQL Server as it is running inside. For connection I use the "Context connection = true", and the function has the SystemDataAccessKind attribute set to Read.

However when I execute my CLR function I get an error saying something like:

"The request for permission of type System.Data.SqlClient.SqlClientPermission...... failed"

I do, as the login user, have been granted the necessary rights, so I don't believe this is the answer to the error.

And my .dll is also signed.

Has this something to do with writing something a config file?

I have had simular problems with reporting services but fixed them by entering a node in the rspolicy.config file. If this is the case here - which .config file should i modify...machine.config?

Where do you execute your CLR proc from, i.e. where do you get the exception?

Niels
|||

If I extract the SQL from the CLR function and runs it as a basic query in Management Studio, everything works fine.

|||

I have also noted than when I try to create an SqlPermission in the code and run the Asset(), I get another type of error:

System.Security.Permissions.SecurityPermissions, mscorlib....

|||What happens if you try to do a "normal" query from the SSMS you are testing from, against a table in a database on the SQL Server you have deployed your assembly to?

Niels
|||

pnp wrote:

Inside Management Studio. Management Studio is running on a different machine than the SQL Server, but the user that I use when logging into Management Studio is dbowner, and the same user that I use to create the assembly and CLR function.

If I extract the SQL from the CLR function and runs it as a basic query in Management Studio, everything works fine.

What if you try and run from the same box that SQL is on?

Niels
|||

Niels, thanks for your suggestions. I have also installed Management Studio on the same server that is running the SQL Server but the error is the same.

Wednesday, March 7, 2012

Permission Reading Registry from Assembly

======== REPOSTED w/MSDN ALIAS ======== We have a custom assembly used by our reports that needs to access SQL
Server and the Registry. In code, prior to making our SQL server
connection, we assert the System.Data.SqlClient.SqlClientPermission and we
are able to connect just fine. Prior to opening the registry key, we assert
the System.Security.Permissions.RegistryPermission, but on the subsequent
call to open the subkey, we get the following exception:
Request for the permission of type
System.Security.Permissions.RegistryPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089 failed.
* We created a code group in the policy config file giving our assembly full
trust.
* The Everyone group has permissions to read the registry key and the value.
* We executed Sysinternal's registry monitor tool and it doesn't appear to
even log the call to open the key.
Environment: Visual Studio.NET 1.1, Reporting Services 1.1, Windows XP
====[BEGIN CODE SNIPPET]============== RegistryKey regTest = null;
try {
RegistryPermission regPermission = new
RegistryPermission(RegistryPermissionAccess.Read,
"HKEY_LOCAL_MACHINE\\SOFTWARE\\0");
regPermission.Assert();
regTest = Registry.LocalMachine;
regTest = regTest.OpenSubKey("SOFTWARE"); // This call fails with the
exception above
return (string)regTest.GetValue("TestVal");
} finally {
if (regTest != null) {
regTest.Close();
}
}
====[END CODE SNIPPET]==============
I don't think this is a registry permission issue since it says the
"request" for the permission failed. However, I would have expected the
request to fail on the assert, not on the subsequent OpenSubKey call.
Does anyone have any suggestions on how to troubleshoot this?
Thanks,
ChrisHi Chris,
Thank you for posting.
Regarding on the SSRS custom assembly registry accessing issue, I think we
should still troubleshoot from the permission setting. And what we can
check is the below things:
1. raw win32 registry access permission
2. .NET CAS permission setting.
For win32 registry access permission, the regmon tool should be able to
capture the failure error
For .NET CAS permission problem, you can consider temporarly turn off the
.net framework's CAS setting through the caspol.exe tool:
#Code Access Security Policy Tool (Caspol.exe) (.NET Framework)
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cptools/htm
l/cpgrfcodeaccesssecuritypolicyutilitycaspolexe.asp
After turn off the CAS and test the custom assembly again to see whether it
works.
Hope this helps.
Regards,
Steven Cheng
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)|||I have copied code out of the help file that opens the LocalMachine key and
calls GetSubKeys(). This fails with the same permissions error. I have
granted the Everyone group Full Control on the LocalMachine key. Using the
caspol.exe tool noted below, I have turned off CAS.
I have been running registry monitor from system internals, and unless I'm
using the tool incorrectly, I don't see any failures or successes. I am
using the RSReportHost to be able to execute the report and step through my
assembly. I don't know what process it would be using to access the
registry.
In regards to the suggestions below:
1. What other pemissions could I add in addition to granting the Everyone
group Full Control? I am still getting the exception.
2. As stated above, I executed the caspol.exe turning off CAS. I am still
getting the exception.
- Chris
=================================Taken from the Registry.LocalMachine field help file sample:
public static string PrintKeys() {
StringBuilder sbResult = new StringBuilder();
RegistryKey rk = Registry.LocalMachine;
// Retrieve all the subkeys for the specified key.
String [] names;
try {
names = rk.GetSubKeyNames(); <=== BOOM
} catch (Exception e) {
return e.Message;
}
int icount = 0;
// Print the contents of the array to the console.
foreach (String s in names) {
sbResult.Append(s);
// The following code puts a limit on the number
// of keys displayed. Comment it out to print the
// complete list.
icount++;
if (icount >= 10)
break;
}
return sbResult.ToString();
}
"Steven Cheng[MSFT]" <stcheng@.online.microsoft.com> wrote in message
news:eeLJoQfWGHA.932@.TK2MSFTNGXA01.phx.gbl...
> Hi Chris,
> Thank you for posting.
> Regarding on the SSRS custom assembly registry accessing issue, I think we
> should still troubleshoot from the permission setting. And what we can
> check is the below things:
> 1. raw win32 registry access permission
> 2. .NET CAS permission setting.
> For win32 registry access permission, the regmon tool should be able to
> capture the failure error
> For .NET CAS permission problem, you can consider temporarly turn off the
> net framework's CAS setting through the caspol.exe tool:
> #Code Access Security Policy Tool (Caspol.exe) (.NET Framework)
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cptools/htm
> l/cpgrfcodeaccesssecuritypolicyutilitycaspolexe.asp
> After turn off the CAS and test the custom assembly again to see whether
> it
> works.
> Hope this helps.
> Regards,
> Steven Cheng
> Microsoft Online Community Support
>
> ==================================================> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ==================================================>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>|||Clarification - When running the RegMon tool, I do see a lot of activity
from other processes, but nothing that I can identify being associated with
my custom assembly.
"Chris Walls" <chwalls2@.community.nospam> wrote in message
news:OIlWD$WXGHA.3492@.TK2MSFTNGP05.phx.gbl...
>I have copied code out of the help file that opens the LocalMachine key and
>calls GetSubKeys(). This fails with the same permissions error. I have
>granted the Everyone group Full Control on the LocalMachine key. Using the
>caspol.exe tool noted below, I have turned off CAS.
> I have been running registry monitor from system internals, and unless I'm
> using the tool incorrectly, I don't see any failures or successes. I am
> using the RSReportHost to be able to execute the report and step through
> my assembly. I don't know what process it would be using to access the
> registry.
> In regards to the suggestions below:
> 1. What other pemissions could I add in addition to granting the Everyone
> group Full Control? I am still getting the exception.
> 2. As stated above, I executed the caspol.exe turning off CAS. I am still
> getting the exception.
> - Chris
> =================================> Taken from the Registry.LocalMachine field help file sample:
> public static string PrintKeys() {
> StringBuilder sbResult = new StringBuilder();
> RegistryKey rk = Registry.LocalMachine;
> // Retrieve all the subkeys for the specified key.
> String [] names;
> try {
> names = rk.GetSubKeyNames(); <=== BOOM
> } catch (Exception e) {
> return e.Message;
> }
> int icount = 0;
> // Print the contents of the array to the console.
> foreach (String s in names) {
> sbResult.Append(s);
> // The following code puts a limit on the number
> // of keys displayed. Comment it out to print the
> // complete list.
> icount++;
> if (icount >= 10)
> break;
> }
> return sbResult.ToString();
> }
>
> "Steven Cheng[MSFT]" <stcheng@.online.microsoft.com> wrote in message
> news:eeLJoQfWGHA.932@.TK2MSFTNGXA01.phx.gbl...
>> Hi Chris,
>> Thank you for posting.
>> Regarding on the SSRS custom assembly registry accessing issue, I think
>> we
>> should still troubleshoot from the permission setting. And what we can
>> check is the below things:
>> 1. raw win32 registry access permission
>> 2. .NET CAS permission setting.
>> For win32 registry access permission, the regmon tool should be able to
>> capture the failure error
>> For .NET CAS permission problem, you can consider temporarly turn off the
>> net framework's CAS setting through the caspol.exe tool:
>> #Code Access Security Policy Tool (Caspol.exe) (.NET Framework)
>> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cptools/htm
>> l/cpgrfcodeaccesssecuritypolicyutilitycaspolexe.asp
>> After turn off the CAS and test the custom assembly again to see whether
>> it
>> works.
>> Hope this helps.
>> Regards,
>> Steven Cheng
>> Microsoft Online Community Support
>>
>> ==================================================>> When responding to posts, please "Reply to Group" via your newsreader so
>> that others may learn and benefit from your issue.
>> ==================================================>>
>> This posting is provided "AS IS" with no warranties, and confers no
>> rights.
>>
>> Get Secure! www.microsoft.com/security
>> (This posting is provided "AS IS", with no warranties, and confers no
>> rights.)
>|||Thanks for your followup Chris,
This seems strange, so far I can not consider any other particular security
related setting either. Should be a environment specific issue. Have you
tried creating a new custom assembly which access some certain registry to
see whether it also suffer the probelm on ths machine?
Regards,
Steven Cheng
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.|||I got a little further. I created a new assembly that only had my registry
code. I ran it as a console application and it successfully read my
registry values. I saw in RegMon that the keys where opened, queried, etc.
I then changed it to a class library and referenced it with a test report.
I was receiving the same permission errors. I turned off security via the
caspol utility and then I was able to successfully read my values. I then
modified my test report to reference my first assembly and it too now works.
Clearly I didn't disable security the last time like I thought I did.
So cleary my entries in the rspreviewpolicy.config file is incorrect. I
thought I was granting full trust to my assembly. Here is my entries. They
are at the end of the file just before the </policy> end tag.
<CodeGroup class="UnionCodeGroup" version="1" PermissionSetName="FullTrust"
Name="TSIRegistryTest">
<IMembershipCondition
class="UrlMembershipCondition"
version="1" Url="C:\Program Files\Microsoft SQL Server\80\Tools\Report
Designer\ReportTest.dll" />
</CodeGroup>
Any help would be greatly appreciated.
- Chris
"Steven Cheng[MSFT]" <stcheng@.online.microsoft.com> wrote in message
news:N9KImB8XGHA.888@.TK2MSFTNGXA01.phx.gbl...
> Thanks for your followup Chris,
> This seems strange, so far I can not consider any other particular
> security
> related setting either. Should be a environment specific issue. Have you
> tried creating a new custom assembly which access some certain registry to
> see whether it also suffer the probelm on ths machine?
> Regards,
> Steven Cheng
> Microsoft Online Community Support
>
> ==================================================> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ==================================================>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>|||Thank you for the response Chris,
So your custom assembly is put in the following location:
C:\Program Files\Microsoft SQL Server\80\Tools\Report
Designer\ReportTest.dll
If so, I think the <CodeGroup > element you pasted should be ok. And the
problem is possibly caused by the location where you add the custom
<codeGroup> in the policy file. As you mentioend that you add it at the
end of the file just before the </policy> end tag. Do you mean that it is
not included/nested within other <codeGroup> ?, like below:
======================...other code group here

</PolicyLevel>
</policy>
</security>
</mscorlib>
</configuration>
==========================
If so, it is not the correct place since the codegroup in .NET code access
policy file is not a flat structure, they're hierarchical and nested...
And our custom code should be put within a "Local Computer"
firstMatchCodeGroup, it is as below:
================= <CodeGroup
class="FirstMatchCodeGroup"
version="1"
PermissionSetName="Execution"
Description="This code group grants
MyComputer code Execution permission. ">
<IMembershipCondition
class="ZoneMembershipCondition"
version="1"
Zone="MyComputer" />

</CodeGroup>
==============
You'll find there is many other sub codegroups nested inside it which are
parallel with each other. If you find it, you can try puting your custom
code group as the sub nested codegroup within it. In addition, you can
also try strong-named your assembly and put it in GAC, then use
strong-named membershipCondition to idenitify it for testing.
BTW, here is a good msdn article describing the code access security in
ASP.NET application(including customizing policy file):
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html
/paght000017.asp
Hope this also helps.
Regards,
Steven Cheng
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)|||Ok, I think I got it. One thing that was screwing me up is that the change
in the rspreviewpolicy.config was not being picked up by the RSReportHost
utility, even when I unloaded and reloaded it. Only when I started
previewing the report with VS.NET did I see a successful execution with CAS
turned on. Now I'm having similar issues on the build server, but I have a
better understanding of how to troubleshoot it.
Thanks for all of the help.
- Chris
"Steven Cheng[MSFT]" <stcheng@.online.microsoft.com> wrote in message
news:J8C4%23YEZGHA.6000@.TK2MSFTNGXA01.phx.gbl...
> Thank you for the response Chris,
> So your custom assembly is put in the following location:
> C:\Program Files\Microsoft SQL Server\80\Tools\Report
> Designer\ReportTest.dll
> If so, I think the <CodeGroup > element you pasted should be ok. And the
> problem is possibly caused by the location where you add the custom
> <codeGroup> in the policy file. As you mentioend that you add it at the
> end of the file just before the </policy> end tag. Do you mean that it is
> not included/nested within other <codeGroup> ?, like below:
> ======================> ...other code group here
> 
> </PolicyLevel>
> </policy>
> </security>
> </mscorlib>
> </configuration>
> ==========================> If so, it is not the correct place since the codegroup in .NET code access
> policy file is not a flat structure, they're hierarchical and nested...
> And our custom code should be put within a "Local Computer"
> firstMatchCodeGroup, it is as below:
> =================> <CodeGroup
> class="FirstMatchCodeGroup"
> version="1"
> PermissionSetName="Execution"
> Description="This code group grants
> MyComputer code Execution permission. ">
> <IMembershipCondition
> class="ZoneMembershipCondition"
> version="1"
> Zone="MyComputer" />
> 
> </CodeGroup>
> ==============> You'll find there is many other sub codegroups nested inside it which are
> parallel with each other. If you find it, you can try puting your custom
> code group as the sub nested codegroup within it. In addition, you can
> also try strong-named your assembly and put it in GAC, then use
> strong-named membershipCondition to idenitify it for testing.
> BTW, here is a good msdn article describing the code access security in
> ASP.NET application(including customizing policy file):
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnpag2/html
> /paght000017.asp
> Hope this also helps.
> Regards,
> Steven Cheng
> Microsoft Online Community Support
>
> ==================================================> When responding to posts, please "Reply to Group" via your newsreader so
> that others may learn and benefit from your issue.
> ==================================================>
> This posting is provided "AS IS" with no warranties, and confers no
> rights.
>
> Get Secure! www.microsoft.com/security
> (This posting is provided "AS IS", with no warranties, and confers no
> rights.)
>
>
>
>
>
>
>
>|||Thanks for your followup Chris,
I'm very glad that you've made progress on this. Also, it's a pleasure to
be of assistance.
Please feel free to post here when there is anything else we can help you.
Good luck!
Regards,
Steven Cheng
Microsoft Online Community Support
==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================
This posting is provided "AS IS" with no warranties, and confers no rights.
Get Secure! www.microsoft.com/security
(This posting is provided "AS IS", with no warranties, and confers no
rights.)

Permission Denied Error

Wednesday, March 21, 2012

Permissions needed to Create Assembly

Permissions needed to Create Assembly

Tuesday, March 20, 2012

Permissions needed to Create Assembly

Permissions needed to Create Assembly

Friday, March 9, 2012

Permission-problem on simple query inside CLR function

Permission-problem on simple query inside CLR function

Wednesday, March 7, 2012

Permission Reading Registry from Assembly

Followers

Blog Archive

About Me