Really need some help on this one. I'm trying to deploy a custom assembly that uses ado.net to access an Oracle database. It works fine in the Preview Tab, which isn't affected by security settings but blows up in the Pop-Up Preview window, which is affected by security settings.
I've added a code group to the rsPreviewPolicy file. It appears to load just fine. I've used the .Net configuration tool to grant the assembly full trust. I've upped the security for the IntraNet zone to Full Trust(an approach that worked for a co-worker) I believe my problem isn't the Reporting Services security layer, but the more general CLR layer. I'm new to .Net and am not sure how to proceed.
Any ideas would be appreciated. The project is dead in the water until I get past this.
Thanks
Doug
--
Posted using Wimdows.net NntpNews Component -
Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup engine supports Post Alerts, Ratings, and Searching.It sounds like you did not explicitly assert permissions to open a database
connection. Unless you assert the permission explicitly in the custom
assembly code, it will fail with a security exception.
Example for opening a connection to a SQL Server:
...
SqlClientPermission permission = new
SqlClientPermission(PermissionState.Unrestricted);
try
{
permission.Assert(); // Assert security permission!
SqlConnection con = new SqlConnection("...");
con.Open();
...
}
You might also want to check out these links:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/RSPROG/htm/rsp_prog_rdl_0so6.asp
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconAssert.asp
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
Robert M. Bruckner
Microsoft SQL Server Reporting Services
This posting is provided "AS IS" with no warranties, and confers no rights.
"SqlJunkies User" <User@.-NOSPAM-SqlJunkies.com> wrote in message
news:O9TAc2cbEHA.904@.TK2MSFTNGP09.phx.gbl...
> Really need some help on this one. I'm trying to deploy a custom assembly
that uses ado.net to access an Oracle database. It works fine in the
Preview Tab, which isn't affected by security settings but blows up in the
Pop-Up Preview window, which is affected by security settings.
> I've added a code group to the rsPreviewPolicy file. It appears to load
just fine. I've used the .Net configuration tool to grant the assembly full
trust. I've upped the security for the IntraNet zone to Full Trust(an
approach that worked for a co-worker) I believe my problem isn't the
Reporting Services security layer, but the more general CLR layer. I'm new
to .Net and am not sure how to proceed.
> Any ideas would be appreciated. The project is dead in the water until I
get past this.
> Thanks
> Doug
>
> --
> Posted using Wimdows.net NntpNews Component -
> Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup engine
supports Post Alerts, Ratings, and Searching.|||Thanks for your response. I tried .Assert with the SQL permissions and got that connection to work. However, I tried the same with the OraclePermission and it's still throwing a SecurityException.
This is a deal breaker for my company and RS. Management is getting very edgy over the deployment/security issues we're dealing with.
Here is my code in the assembly:
OraclePermission op = new OraclePermission(PermissionState.Unrestricted);
op.Assert;
strConn = "Data Source=TSD01;User ID=SchemaName;password=password;";
OracleConnection cn = new OracleConnection(strConn);
cn.Open();
This works in the PreviewTab the PopUp Preview but not on the remote Production box.
Any ideas?
Doug
"Robert Bruckner [MSFT]" wrote:
> It sounds like you did not explicitly assert permissions to open a database
> connection. Unless you assert the permission explicitly in the custom
> assembly code, it will fail with a security exception.
> Example for opening a connection to a SQL Server:
> ...
> SqlClientPermission permission = new
> SqlClientPermission(PermissionState.Unrestricted);
> try
> {
> permission.Assert(); // Assert security permission!
> SqlConnection con = new SqlConnection("...");
> con.Open();
> ...
> }
> You might also want to check out these links:
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/RSPROG/htm/rsp_prog_rdl_0so6.asp
> http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconAssert.asp
> http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
> http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
>
> --
> Robert M. Bruckner
> Microsoft SQL Server Reporting Services
> This posting is provided "AS IS" with no warranties, and confers no rights.
> "SqlJunkies User" <User@.-NOSPAM-SqlJunkies.com> wrote in message
> news:O9TAc2cbEHA.904@.TK2MSFTNGP09.phx.gbl...
> > Really need some help on this one. I'm trying to deploy a custom assembly
> that uses ado.net to access an Oracle database. It works fine in the
> Preview Tab, which isn't affected by security settings but blows up in the
> Pop-Up Preview window, which is affected by security settings.
> >
> > I've added a code group to the rsPreviewPolicy file. It appears to load
> just fine. I've used the .Net configuration tool to grant the assembly full
> trust. I've upped the security for the IntraNet zone to Full Trust(an
> approach that worked for a co-worker) I believe my problem isn't the
> Reporting Services security layer, but the more general CLR layer. I'm new
> to .Net and am not sure how to proceed.
> >
> > Any ideas would be appreciated. The project is dead in the water until I
> get past this.
> >
> > Thanks
> >
> > Doug
> >
> >
> > --
> > Posted using Wimdows.net NntpNews Component -
> >
> > Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup engine
> supports Post Alerts, Ratings, and Searching.
>
>|||If you read the MSDN documentation for the OraclePermission class and the
SqlClientPermission class and compare them, you will notice the following
statement:
"This class [i.e. OraclePermission] is intended for future use when the .NET
Framework Data Provider for Oracle is enabled for partial trust scenarios.
The provider currently requires FullTrust permission."
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemdataoracleclientoraclepermissionclasstopic.asp
I.e. asserting the OraclePermission won't help you get around the Security
exception, because the .NET data provider for Oracle _must_ have full trust
and does not work in a partially trusted environment. This is inherit to the
current design of the data provider and the Oracle client (running unmanaged
code internally).
Note: The managed provider for SQL Server is enabled for partial trust
scenarios, therefore it is sufficient (and advisable) to just assert the
SqlClientPermission.
Here is how you assert full trust in your custom assembly using an attribute
on the method that opens an Oracle connection:
[PermissionSet(SecurityAction.Assert, Unrestricted=true)]
public foo()
{
// your code
strConn = "Data Source=TSD01;User ID=SchemaName;password=password;";
OracleConnection cn = new OracleConnection(strConn);
cn.Open();
// ...
}
Robert M. Bruckner
Microsoft SQL Server Reporting Services
This posting is provided "AS IS" with no warranties, and confers no rights.
"dwelty" <dwelty@.discussions.microsoft.com> wrote in message
news:A1C06F67-7893-4D9D-9AC4-E1E63BDBB8C5@.microsoft.com...
> Thanks for your response. I tried .Assert with the SQL permissions and
got that connection to work. However, I tried the same with the
OraclePermission and it's still throwing a SecurityException.
> This is a deal breaker for my company and RS. Management is getting very
edgy over the deployment/security issues we're dealing with.
> Here is my code in the assembly:
> OraclePermission op = new OraclePermission(PermissionState.Unrestricted);
> op.Assert;
> strConn = "Data Source=TSD01;User ID=SchemaName;password=password;";
> OracleConnection cn = new OracleConnection(strConn);
> cn.Open();
> This works in the PreviewTab the PopUp Preview but not on the remote
Production box.
> Any ideas?
> Doug
>
> "Robert Bruckner [MSFT]" wrote:
> > It sounds like you did not explicitly assert permissions to open a
database
> > connection. Unless you assert the permission explicitly in the custom
> > assembly code, it will fail with a security exception.
> > Example for opening a connection to a SQL Server:
> > ...
> > SqlClientPermission permission = new
> > SqlClientPermission(PermissionState.Unrestricted);
> > try
> > {
> > permission.Assert(); // Assert security permission!
> > SqlConnection con = new SqlConnection("...");
> > con.Open();
> > ...
> > }
> >
> > You might also want to check out these links:
> >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/RSPROG/htm/rsp_prog_rdl_0so6.asp
> >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconAssert.asp
> >
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
> > http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
> >
> >
> > --
> > Robert M. Bruckner
> > Microsoft SQL Server Reporting Services
> > This posting is provided "AS IS" with no warranties, and confers no
rights.
> >
> > "SqlJunkies User" <User@.-NOSPAM-SqlJunkies.com> wrote in message
> > news:O9TAc2cbEHA.904@.TK2MSFTNGP09.phx.gbl...
> > > Really need some help on this one. I'm trying to deploy a custom
assembly
> > that uses ado.net to access an Oracle database. It works fine in the
> > Preview Tab, which isn't affected by security settings but blows up in
the
> > Pop-Up Preview window, which is affected by security settings.
> > >
> > > I've added a code group to the rsPreviewPolicy file. It appears to
load
> > just fine. I've used the .Net configuration tool to grant the assembly
full
> > trust. I've upped the security for the IntraNet zone to Full Trust(an
> > approach that worked for a co-worker) I believe my problem isn't the
> > Reporting Services security layer, but the more general CLR layer. I'm
new
> > to .Net and am not sure how to proceed.
> > >
> > > Any ideas would be appreciated. The project is dead in the water
until I
> > get past this.
> > >
> > > Thanks
> > >
> > > Doug
> > >
> > >
> > > --
> > > Posted using Wimdows.net NntpNews Component -
> > >
> > > Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup
engine
> > supports Post Alerts, Ratings, and Searching.
> >
> >
> >|||Regarding security permissions: there are typically always two ways to
assert them. Use attributes (as I did in the Oracle code snippet) or create
permission objects and call assert (as I did in the SQL Server code
snippet).
The MSDN documentation contains information for every class and method that
needs certain security permissions at runtime. MSDN also contains several
articles about CAS (code access security) in the .NET framework. Starting
point:
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconCodeAccessSecurity.asp
You might also want to check out this recent article in the MSDN magazine:
http://msdn.microsoft.com/msdnmag/issues/04/06/NET/default.aspx
Specifically for Reporting Services you should also read this:
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
However, it can be very time consuming to check all classes and function
calls and check which security permissions are needed. The good news is
there are improvements for this in the upcoming .NET 2.0 Framework. Visual
Studio 2005 ("Whidbey") Beta 1 (e.g. download one of the "Express" editions
from http://lab.msdn.microsoft.com/vs2005/) contains a nice command line
tool related to code access security: PermCalc. After installation it is
located at \Program Files\Microsoft Visual Studio 8\Common7\IDE\Permcalc.exe
PermCalc estimates all necessary security permissions that must be granted
for every dll entrypoint in order to avoid security exceptions at runtime.
This estimation is done by performing static IL analysis. Permcalc is also
integrated into the VS Whidbey UI. In order to get the list of necessary
permissions for all custom assembly entry points, you would just run e.g.
permcalc -progress -library CustomAssembly.dll
Therefore you can more easily identify which missing security permission
asserts and grants cause the execution of custom assemblies to fail. Note:
PermCalc can even analyze dlls compiled with older versions of the .NET
Framework (e.g. VS 2003). However, you will need the .NET 2.0 Framework
installed in order to run PermCalc.exe.
--
This posting is provided "AS IS" with no warranties, and confers no rights.
"dwelty" <dwelty@.discussions.microsoft.com> wrote in message
news:33B95568-725F-44D6-BFA2-509BDF76A50F@.microsoft.com...
> Robert,
> This worked. Thank you so much. I remember reading at some point in
all this the limitations of the current version of the OraclePermission
class. However, being new to the security model in the .Net framework and
new to RS, I apparently didn't grasp the implications.
> How do you become an expert in all of this? Given my reading of the
documentation that's currently available, I would have taken forever to come
up with that line of code you sent that made all the difference. I'm really
wearying of pasting in snippets of code from various sources and hoping they
work. I'd like to know the how's and why's of this. Do you know of a good
place to start?
> Thanks so much again.
> Doug
>
> "Robert Bruckner [MSFT]" wrote:
> > If you read the MSDN documentation for the OraclePermission class and
the
> > SqlClientPermission class and compare them, you will notice the
following
> > statement:
> >
> > "This class [i.e. OraclePermission] is intended for future use when the
.NET
> > Framework Data Provider for Oracle is enabled for partial trust
scenarios.
> > The provider currently requires FullTrust permission."
> >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpref/html/frlrfsystemdataoracleclientoraclepermissionclasstopic.asp
> >
> > I.e. asserting the OraclePermission won't help you get around the
Security
> > exception, because the .NET data provider for Oracle _must_ have full
trust
> > and does not work in a partially trusted environment. This is inherit to
the
> > current design of the data provider and the Oracle client (running
unmanaged
> > code internally).
> > Note: The managed provider for SQL Server is enabled for partial trust
> > scenarios, therefore it is sufficient (and advisable) to just assert the
> > SqlClientPermission.
> >
> > Here is how you assert full trust in your custom assembly using an
attribute
> > on the method that opens an Oracle connection:
> >
> > [PermissionSet(SecurityAction.Assert, Unrestricted=true)]
> > public foo()
> > {
> > // your code
> > strConn = "Data Source=TSD01;User ID=SchemaName;password=password;";
> > OracleConnection cn = new OracleConnection(strConn);
> > cn.Open();
> > // ...
> > }
> >
> >
> > --
> > Robert M. Bruckner
> > Microsoft SQL Server Reporting Services
> > This posting is provided "AS IS" with no warranties, and confers no
rights.
> >
> >
> >
> >
> >
> > "dwelty" <dwelty@.discussions.microsoft.com> wrote in message
> > news:A1C06F67-7893-4D9D-9AC4-E1E63BDBB8C5@.microsoft.com...
> > > Thanks for your response. I tried .Assert with the SQL permissions
and
> > got that connection to work. However, I tried the same with the
> > OraclePermission and it's still throwing a SecurityException.
> > >
> > > This is a deal breaker for my company and RS. Management is getting
very
> > edgy over the deployment/security issues we're dealing with.
> > >
> > > Here is my code in the assembly:
> > >
> > > OraclePermission op = new
OraclePermission(PermissionState.Unrestricted);
> > > op.Assert;
> > > strConn = "Data Source=TSD01;User ID=SchemaName;password=password;";
> > > OracleConnection cn = new OracleConnection(strConn);
> > > cn.Open();
> > >
> > > This works in the PreviewTab the PopUp Preview but not on the remote
> > Production box.
> > >
> > > Any ideas?
> > >
> > > Doug
> > >
> > >
> > > "Robert Bruckner [MSFT]" wrote:
> > >
> > > > It sounds like you did not explicitly assert permissions to open a
> > database
> > > > connection. Unless you assert the permission explicitly in the
custom
> > > > assembly code, it will fail with a security exception.
> > > > Example for opening a connection to a SQL Server:
> > > > ...
> > > > SqlClientPermission permission = new
> > > > SqlClientPermission(PermissionState.Unrestricted);
> > > > try
> > > > {
> > > > permission.Assert(); // Assert security
permission!
> > > > SqlConnection con = new SqlConnection("...");
> > > > con.Open();
> > > > ...
> > > > }
> > > >
> > > > You might also want to check out these links:
> > > >
> >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/RSPROG/htm/rsp_prog_rdl_0so6.asp
> > > >
> >
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconAssert.asp
> > > >
> >
http://msdn.microsoft.com/library/?url=/library/en-us/dnsql2k/html/dngrfCodeAccessSecurityInSQLServer2000ReportingServices.asp
> > > >
http://msdn.microsoft.com/library/en-us/RSPROG/htm/rsp_prog_rdl_8wyq.asp
> > > >
> > > >
> > > > --
> > > > Robert M. Bruckner
> > > > Microsoft SQL Server Reporting Services
> > > > This posting is provided "AS IS" with no warranties, and confers no
> > rights.
> > > >
> > > > "SqlJunkies User" <User@.-NOSPAM-SqlJunkies.com> wrote in message
> > > > news:O9TAc2cbEHA.904@.TK2MSFTNGP09.phx.gbl...
> > > > > Really need some help on this one. I'm trying to deploy a custom
> > assembly
> > > > that uses ado.net to access an Oracle database. It works fine in
the
> > > > Preview Tab, which isn't affected by security settings but blows up
in
> > the
> > > > Pop-Up Preview window, which is affected by security settings.
> > > > >
> > > > > I've added a code group to the rsPreviewPolicy file. It appears
to
> > load
> > > > just fine. I've used the .Net configuration tool to grant the
assembly
> > full
> > > > trust. I've upped the security for the IntraNet zone to Full
Trust(an
> > > > approach that worked for a co-worker) I believe my problem isn't
the
> > > > Reporting Services security layer, but the more general CLR layer.
I'm
> > new
> > > > to .Net and am not sure how to proceed.
> > > > >
> > > > > Any ideas would be appreciated. The project is dead in the water
> > until I
> > > > get past this.
> > > > >
> > > > > Thanks
> > > > >
> > > > > Doug
> > > > >
> > > > >
> > > > > --
> > > > > Posted using Wimdows.net NntpNews Component -
> > > > >
> > > > > Post Made from http://www.SqlJunkies.com/newsgroups Our newsgroup
> > engine
> > > > supports Post Alerts, Ratings, and Searching.
> > > >
> > > >
> > > >
> >
> >
> >
1234123412 wrote:
