I have a 3rd party DLL that I need to give Full Trust to. Here is the code in
the prvpolicy.config file I am using to do so. My question is, what am I
doing wrong?
Does it need a certain name or is the <IMembershipCondition
class="UrlMembershipCondition" the wrong thing or?
<CodeGroup class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="AzaleaBarcode"
Description="Code group for processing azalea font barcodes">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
Url="C:\Program Files\Azalea\Bar Code Engine\Barcode.dll"
/>
</CodeGroup>We're working on the same exact problem. Has anyone solved this problem?
"Pinolian" <Pinolian@.discussions.microsoft.com> wrote in message news:<B8247CA5-44C0-4E59-BE3D-EABDFC22EEE1@.microsoft.com>...
> I have a 3rd party DLL that I need to give Full Trust to. Here is the code in
> the prvpolicy.config file I am using to do so. My question is, what am I
> doing wrong?
> Does it need a certain name or is the <IMembershipCondition
> class="UrlMembershipCondition" the wrong thing or?
>
> <CodeGroup class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="AzaleaBarcode"
> Description="Code group for processing azalea font barcodes">
> <IMembershipCondition class="UrlMembershipCondition"
> version="1"
> Url="C:\Program Files\Azalea\Bar Code Engine\Barcode.dll"
> />
> </CodeGroup>
Showing posts with label security. Show all posts
Showing posts with label security. Show all posts
Wednesday, March 7, 2012
Code Access Security across multiple assembly security extension
Hello there I have trying to figure out for days how to enable FullTrust for my Reporting Services security extension.
I can successfully run the sample, but my implementation which splits the data and verification logic across two dlls fails each time it reaches the data layer.
Simply and succinctly as I can write it my security extension consists of the following.
Business.dll
This dll is configured in RSReportServer.config, again as per the Microsoft sample.
This dll is also configured in rssvrpolicy.config, I have used UrlMembershipCondition and StrongNameMemberCondition successfully.
This is called successfully by Reporting Service security extension as it is set up no differently to the samples from Microsoft.
I can even debug into this dll to the point it fails.
Data.dll
This is called by the Business.dll to get any data from the database used to authenticate the user.
It is the call to Data.dll that fails, with System.Web.Services.Protocols.SoapException: Server was unable to process request. > System.Security.Policy.PolicyException: Required permissions cannot be acquired So how do I enable the security extension to allow access to Data.dll. I imagine it is a matter of finding the right code group combination but I can't seem to fathom it out. Or am I barking up the wrong tree. I am also using Enterprise Library, so I guess I would have to apply any solution to those dlls too. Many thanks for any help in advance, Gurbhajan ps ignore my lame signature below.
If the same solution applies to 2005 and 2000, I shall be happy to hear that too as I shall use the 2005 when it released and so will have to migrate the code.
Thanks again,
Gurbhajan|||i am experiencing a similar issue. my custom authentication DLL worked until i changed it to call out to a web service using WSE2.0(sp3). as soon as it tries to create the instance of my proxy class, i get that error. has anyone figured this out?|||i should add that my authentication DLL actually calls methods in two other DLLs - Microsoft.Web.Services2.dll and a little error logger i wrote. i configured the error logger in rssrvpolicy.config, and it works without a hitch. i tried the same with the WSE DLL, in c:\program files\microsoft wse\v2.0, but no go. is it because Microsoft.Web.Services2.dll is in the GAC? how do i go about instructing Reporting Services to trust a DLL that's in the GAC?
... so i decided to see if i could find out before posting that... and it was good thinking. i added the following to rssrvpolicy.config:
<CodeGroup class="UnionCodeGroup" Version="1" PermissionSetName="FullTrust" Name="assemblies in the GAC">
<IMembershipCondition class="UrlMembershipCondition" Version="1" Url="$Gac$/*" />
</CodeGroup>
to the original poster: does your DLL reference any GAC DLLs that aren't signed with the Microsoft strong name (WSE apparently is not)? i tried to fix the error by wrapping my proxy in another DLL, into which i could step with the debugger fine, but i still got that error as soon as any method tried to touch a reference to the WSE proxy class. that's what keyed me off to trusting the DLL in the GAC.
i hope this helps.|||i couldn't get $gac$/assemblyname to work. but i replaced it with a StrongNameMembershipCondition with the PublicKeyBlob extracted from Microsoft.Web.Services2.dll, and i am now in business.
but if you're not using WSE, then this probably won't help. but i guess good advice would be to make sure any assemblies your custom DLL is using have a strong name, and be sure they're in the policy file.|||
sorry to spam your thread. but i belatedly noticed that you said you're using Enterprise Library. so make sure the EL assemblies are signed (you may have to sign them yourself) and add a code group for that (there are already a few StrongNameMembershipCondition code groups in rssrvpolicy.config, if you need examples) or just add code groups for the individual assemblies you're using. basically, everything you're using needs to be trusted, or it probably won't work.
|||Thank you Scott, I have only just returned to this thread after having solved the problem some time ago with the very solution you have described.It is rather a big job signing Enterprise Library but the trick is to sign it with one key so that you only need to add one Code Group to the policy file to cover all of the dlls that may be loaded by your custom extension.
I shall update this thread further a little later on as I am now in the middle of deploying the solution and add any new experiences if I encounter them.
Gurbhajan|||
Also, if you have assemblies that you CANNOT sign, try using the UrlMembershipCondition for those assemblies. I just did this with a custom FormsAuth Security Extension that had dependencies upon 3rd party libraries that were not signed.
Someone really needs to write a small whitepaper on CAS and Sql Reporting extensions, since it can be quite a pain.
Maybe I'll blog about it one day when I have more time.... (note to self)
~Lance
|||I echo that. There are very few documented use cases and majority of developers are struggling with security set-up. A lot of time can be saved if clear examples are given.
We also need recommnedations for best practices as there are many ways to implement code security.
Code Access Security across multiple assembly security extension
Hello there I have trying to figure out for days how to enable FullTrust for my Reporting Services security extension.
I can successfully run the sample, but my implementation which splits the data and verification logic across two dlls fails each time it reaches the data layer.
Simply and succinctly as I can write it my security extension consists of the following.
Business.dll
This dll is configured in RSReportServer.config, again as per the Microsoft sample.
This dll is also configured in rssvrpolicy.config, I have used UrlMembershipCondition and StrongNameMemberCondition successfully.
This is called successfully by Reporting Service security extension as it is set up no differently to the samples from Microsoft.
I can even debug into this dll to the point it fails.
Data.dll
This is called by the Business.dll to get any data from the database used to authenticate the user.
It is the call to Data.dll that fails, with System.Web.Services.Protocols.SoapException: Server was unable to process request. > System.Security.Policy.PolicyException: Required permissions cannot be acquired So how do I enable the security extension to allow access to Data.dll. I imagine it is a matter of finding the right code group combination but I can't seem to fathom it out. Or am I barking up the wrong tree. I am also using Enterprise Library, so I guess I would have to apply any solution to those dlls too. Many thanks for any help in advance, Gurbhajan ps ignore my lame signature below.
If the same solution applies to 2005 and 2000, I shall be happy to hear that too as I shall use the 2005 when it released and so will have to migrate the code.
Thanks again,
Gurbhajan|||i am experiencing a similar issue. my custom authentication DLL worked until i changed it to call out to a web service using WSE2.0(sp3). as soon as it tries to create the instance of my proxy class, i get that error. has anyone figured this out?|||i should add that my authentication DLL actually calls methods in two other DLLs - Microsoft.Web.Services2.dll and a little error logger i wrote. i configured the error logger in rssrvpolicy.config, and it works without a hitch. i tried the same with the WSE DLL, in c:\program files\microsoft wse\v2.0, but no go. is it because Microsoft.Web.Services2.dll is in the GAC? how do i go about instructing Reporting Services to trust a DLL that's in the GAC?
... so i decided to see if i could find out before posting that... and it was good thinking. i added the following to rssrvpolicy.config:
<CodeGroup class="UnionCodeGroup" Version="1" PermissionSetName="FullTrust" Name="assemblies in the GAC">
<IMembershipCondition class="UrlMembershipCondition" Version="1" Url="$Gac$/*" />
</CodeGroup>
to the original poster: does your DLL reference any GAC DLLs that aren't signed with the Microsoft strong name (WSE apparently is not)? i tried to fix the error by wrapping my proxy in another DLL, into which i could step with the debugger fine, but i still got that error as soon as any method tried to touch a reference to the WSE proxy class. that's what keyed me off to trusting the DLL in the GAC.
i hope this helps.|||i couldn't get $gac$/assemblyname to work. but i replaced it with a StrongNameMembershipCondition with the PublicKeyBlob extracted from Microsoft.Web.Services2.dll, and i am now in business.
but if you're not using WSE, then this probably won't help. but i guess good advice would be to make sure any assemblies your custom DLL is using have a strong name, and be sure they're in the policy file.|||
sorry to spam your thread. but i belatedly noticed that you said you're using Enterprise Library. so make sure the EL assemblies are signed (you may have to sign them yourself) and add a code group for that (there are already a few StrongNameMembershipCondition code groups in rssrvpolicy.config, if you need examples) or just add code groups for the individual assemblies you're using. basically, everything you're using needs to be trusted, or it probably won't work.
|||Thank you Scott, I have only just returned to this thread after having solved the problem some time ago with the very solution you have described.It is rather a big job signing Enterprise Library but the trick is to sign it with one key so that you only need to add one Code Group to the policy file to cover all of the dlls that may be loaded by your custom extension.
I shall update this thread further a little later on as I am now in the middle of deploying the solution and add any new experiences if I encounter them.
Gurbhajan|||
Also, if you have assemblies that you CANNOT sign, try using the UrlMembershipCondition for those assemblies. I just did this with a custom FormsAuth Security Extension that had dependencies upon 3rd party libraries that were not signed.
Someone really needs to write a small whitepaper on CAS and Sql Reporting extensions, since it can be quite a pain.
Maybe I'll blog about it one day when I have more time.... (note to self)
~Lance
|||I echo that. There are very few documented use cases and majority of developers are struggling with security set-up. A lot of time can be saved if clear examples are given.
We also need recommnedations for best practices as there are many ways to implement code security.
Code Access Security across multiple assembly security extension
Hello there I have trying to figure out for days how to enable FullTrust for my Reporting Services security extension.
I can successfully run the sample, but my implementation which splits the data and verification logic across two dlls fails each time it reaches the data layer.
Simply and succinctly as I can write it my security extension consists of the following.
Business.dll
This dll is configured in RSReportServer.config, again as per the Microsoft sample.
This dll is also configured in rssvrpolicy.config, I have used UrlMembershipCondition and StrongNameMemberCondition successfully.
This is called successfully by Reporting Service security extension as it is set up no differently to the samples from Microsoft.
I can even debug into this dll to the point it fails.
Data.dll
This is called by the Business.dll to get any data from the database used to authenticate the user.
It is the call to Data.dll that fails, with System.Web.Services.Protocols.SoapException: Server was unable to process request. > System.Security.Policy.PolicyException: Required permissions cannot be acquired So how do I enable the security extension to allow access to Data.dll. I imagine it is a matter of finding the right code group combination but I can't seem to fathom it out. Or am I barking up the wrong tree. I am also using Enterprise Library, so I guess I would have to apply any solution to those dlls too. Many thanks for any help in advance, Gurbhajan ps ignore my lame signature below.
If the same solution applies to 2005 and 2000, I shall be happy to hear that too as I shall use the 2005 when it released and so will have to migrate the code.
Thanks again,
Gurbhajan|||i am experiencing a similar issue. my custom authentication DLL worked until i changed it to call out to a web service using WSE2.0(sp3). as soon as it tries to create the instance of my proxy class, i get that error. has anyone figured this out?|||i should add that my authentication DLL actually calls methods in two other DLLs - Microsoft.Web.Services2.dll and a little error logger i wrote. i configured the error logger in rssrvpolicy.config, and it works without a hitch. i tried the same with the WSE DLL, in c:\program files\microsoft wse\v2.0, but no go. is it because Microsoft.Web.Services2.dll is in the GAC? how do i go about instructing Reporting Services to trust a DLL that's in the GAC?
... so i decided to see if i could find out before posting that... and it was good thinking. i added the following to rssrvpolicy.config:
<CodeGroup class="UnionCodeGroup" Version="1" PermissionSetName="FullTrust" Name="assemblies in the GAC">
<IMembershipCondition class="UrlMembershipCondition" Version="1" Url="$Gac$/*" />
</CodeGroup>
to the original poster: does your DLL reference any GAC DLLs that aren't signed with the Microsoft strong name (WSE apparently is not)? i tried to fix the error by wrapping my proxy in another DLL, into which i could step with the debugger fine, but i still got that error as soon as any method tried to touch a reference to the WSE proxy class. that's what keyed me off to trusting the DLL in the GAC.
i hope this helps.|||i couldn't get $gac$/assemblyname to work. but i replaced it with a StrongNameMembershipCondition with the PublicKeyBlob extracted from Microsoft.Web.Services2.dll, and i am now in business.
but if you're not using WSE, then this probably won't help. but i guess good advice would be to make sure any assemblies your custom DLL is using have a strong name, and be sure they're in the policy file.|||
sorry to spam your thread. but i belatedly noticed that you said you're using Enterprise Library. so make sure the EL assemblies are signed (you may have to sign them yourself) and add a code group for that (there are already a few StrongNameMembershipCondition code groups in rssrvpolicy.config, if you need examples) or just add code groups for the individual assemblies you're using. basically, everything you're using needs to be trusted, or it probably won't work.
|||Thank you Scott, I have only just returned to this thread after having solved the problem some time ago with the very solution you have described.It is rather a big job signing Enterprise Library but the trick is to sign it with one key so that you only need to add one Code Group to the policy file to cover all of the dlls that may be loaded by your custom extension.
I shall update this thread further a little later on as I am now in the middle of deploying the solution and add any new experiences if I encounter them.
Gurbhajan|||
Also, if you have assemblies that you CANNOT sign, try using the UrlMembershipCondition for those assemblies. I just did this with a custom FormsAuth Security Extension that had dependencies upon 3rd party libraries that were not signed.
Someone really needs to write a small whitepaper on CAS and Sql Reporting extensions, since it can be quite a pain.
Maybe I'll blog about it one day when I have more time.... (note to self)
~Lance
|||I echo that. There are very few documented use cases and majority of developers are struggling with security set-up. A lot of time can be saved if clear examples are given.
We also need recommnedations for best practices as there are many ways to implement code security.
Code Access Security
I am attempting to customize code access security so that a custom assembly
can read from the registry. I added a new permission set like this:
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="GPCRegistryPermissionSet">
<IPermission class="RegistryPermission"
version="1"
Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
/>
<IPermission
class="SecurityPermission"
version="1"
Flags="Execution, Assertion"
/>
</PermissionSet>
I added a new code group like this:
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName=" GPCRegistryPermissionSet"
Name="GPCCodeGroup"
Description="GPC Key Retrieval. ">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
URL="C:\Program Files\Microsoft SQL
Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
</CodeGroup>
After adding these two entries to rssrvpolicy.config, when I try to access
the Reporting Services home page, I get the message "Unable to communicate
with report server. Please verify that the report server is operational."
After some experimentation, I found that if I remove the new code group
section, then the Reporting Services home page will come up fine. So there is
something wrong with the format or placement of the new code group section,
but I can't figure out what. The full rssrvpolicy.config file is listed
below. Please help, thanks.
<configuration>
<mscorlib>
<security>
<policy>
<PolicyLevel version="1">
<SecurityClasses>
<SecurityClass Name="AllMembershipCondition"
Description="System.Security.Policy.AllMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="AspNetHostingPermission"
Description="System.Web.AspNetHostingPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="DnsPermission"
Description="System.Net.DnsPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="EnvironmentPermission"
Description="System.Security.Permissions.EnvironmentPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="FileIOPermission"
Description="System.Security.Permissions.FileIOPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="FirstMatchCodeGroup"
Description="System.Security.Policy.FirstMatchCodeGroup, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="IsolatedStorageFilePermission"
Description="System.Security.Permissions.IsolatedStorageFilePermission,
mscorlib, Version=1.0.5000.0, Culture=neutral,
PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="NamedPermissionSet"
Description="System.Security.NamedPermissionSet"/>
<SecurityClass Name="PrintingPermission"
Description="System.Drawing.Printing.PrintingPermission, System.Drawing,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
<SecurityClass Name="ReflectionPermission"
Description="System.Security.Permissions.ReflectionPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="RegistryPermission"
Description="System.Security.Permissions.RegistryPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="SecurityPermission"
Description="System.Security.Permissions.SecurityPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="SocketPermission"
Description="System.Net.SocketPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="SqlClientPermission"
Description="System.Data.SqlClient.SqlClientPermission, System.Data,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="StrongNameMembershipCondition"
Description="System.Security.Policy.StrongNameMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="UnionCodeGroup"
Description="System.Security.Policy.UnionCodeGroup, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="UrlMembershipCondition"
Description="System.Security.Policy.UrlMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="WebPermission"
Description="System.Net.WebPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="ZoneMembershipCondition"
Description="System.Security.Policy.ZoneMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
</SecurityClasses>
<NamedPermissionSets>
<PermissionSet
class="NamedPermissionSet"
version="1"
Unrestricted="true"
Name="FullTrust"
Description="Allows full access to all
resources"
/>
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="Nothing"
Description="Denies all resources, including
the right to execute"
/>
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="Execution">
<IPermission
class="SecurityPermission"
version="1"
Flags="Execution"
/>
</PermissionSet>
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="GPCRegistryPermissionSet">
<IPermission class="RegistryPermission"
version="1"
Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
/>
<IPermission
class="SecurityPermission"
version="1"
Flags="Execution, Assertion"
/>
</PermissionSet>
</NamedPermissionSets>
<CodeGroup
class="FirstMatchCodeGroup"
version="1"
PermissionSetName="Nothing">
<IMembershipCondition
class="AllMembershipCondition"
version="1"
/>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="Execution"
Name="Report_Expressions_Default_Permissions"
Description="This code group grants default
permissions for code in report expressions and Code element. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100512C8E872E28569E733BCB123794DAB55111A0570B3B3D4DE3794153DEA5EFB7C3FEA9F2D8236CFF320C4FD0EAD5F677880BF6C181F296C751C5F6E65B04D3834C02F792FEE0FE452915D44AFE74A0C27E0D8E4B8D04EC52A8E281E01FF47E7D694E6C7275A09AFCBFD8CC82705A06B20FD6EF61EBBA6873E29C8C0F2CAEDDA2"
/>
</CodeGroup>
<CodeGroup
class="FirstMatchCodeGroup"
version="1"
PermissionSetName="Execution"
Description="This code group grants
MyComputer code Execution permission. ">
<IMembershipCondition
class="ZoneMembershipCondition"
version="1"
Zone="MyComputer" />
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Microsoft_Strong_Name"
Description="This code group grants code
signed with the Microsoft strong name full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Ecma_Strong_Name"
Description="This code group grants code
signed with the ECMA strong name full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="00000000000000000400000000000000"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Report_Server_Strong_Name"
Description="This code group grants
Report Server code full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100272736AD6E5F9586BAC2D531EABC3ACC666C2F8EC879FA94F8F7B0327D2FF2ED523448F83C3D5C5DD2DFC7BC99C5286B2C125117BF5CBE242B9D41750732B2BDFFE649C6EFB8E5526D526FDD130095ECDB7BF210809C6CDAD8824FAA9AC0310AC3CBA2AA0523567B2DFA7FE250B30FACBD62D4EC99B94AC47C7D3B28F1F6E4C8"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Dundas_Strong_Name"
Description="This code group grants
Dundas assemblies. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010043D98F8A9067EF3BCD442ADE2DD48CC6A6FACBCEB1C42DE2847B0A464096C02EEBF6FD87E3889BEED32B9ABD1525A11A282232CD4C46CC8123F8CC08A113CD435429646220969FF4447348D1C21874670834C7A7E89EA8956FC00E0F84FD3DF6FB3EBF21774438AF9E760414FDE06BC2C3AF35FF3DD87578630ED13FE12CBDBC"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust">
<IMembershipCondition
class="UrlMembershipCondition"
version="1"
Url="$CodeGen$/*"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="SharePoint_Server_Strong_Name"
Description="This code group grants
SharePoint Server code full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100AFD4A0E7724151D5DD52CB23A30DED7C0091CC01CFE94B2BCD85B3F4EEE3C4D8F6417BFF763763A996D6B2DFC1E7C29BCFB8299779DF8785CDE2C168CEEE480E570725F2468E782A9C2401302CF6DC17E119118ED2011937BAE9698357AD21E8B6DFB40475D16E87EB03C744A5D32899A0DBC596A6B2CFA1E509BE5FBD09FACF"
/>
</CodeGroup>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName=" GPCRegistryPermissionSet"
Name="GPCCodeGroup"
Description="GPC Key Retrieval. ">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
URL="C:\Program Files\Microsoft SQL
Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
</CodeGroup>
</CodeGroup>
</PolicyLevel>
</policy>
</security>
</mscorlib>
</configuration>I managed to figure out the solution. I didn't have the syntax for the code
group quite right. The correct format should be:
<CodeGroup class="UnionCodeGroup"
version="1"
PermissionSetName="GPCRegistry"
Name="GPC_Reports"
Description="Custom Assemblies for GPC
Reports">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
Url="file://C:/Program
Files/Microsoft SQL Server/MSSQL/Reporting
Services/ReportServer/bin/gpc.crypto.dll"/>
</CodeGroup>
I also discovered that editing policy files by hand is the hard way. (I
haven't had much experience with code access security.)
The easier way is to use the GUI tool mscorcfg.msc and make changes to the
the Machine policy file. Then, cut and paste the changes
from security.config to rssrvpolicy.config. Be sure to make a backup copy of
the .config files before making any changes. You can also access
the GUI tool via the Microsoft .NET Framework 1.1 Configuration shortcut in
Administrative Tools.
BTW - in the code remember to include the correct security attributes like so:
[RegistryPermissionAttribute(SecurityAction.Assert,
Read=@." HKEY_LOCAL_MACHINE\SOFTWARE\GPC")]
public static string getEncryptionKey()
{
.
.
.
"Joel Daniels" wrote:
> I am attempting to customize code access security so that a custom assembly
> can read from the registry. I added a new permission set like this:
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="GPCRegistryPermissionSet">
> <IPermission class="RegistryPermission"
> version="1"
> Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
> />
> <IPermission
> class="SecurityPermission"
> version="1"
> Flags="Execution, Assertion"
> />
> </PermissionSet>
> I added a new code group like this:
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName=" GPCRegistryPermissionSet"
> Name="GPCCodeGroup"
> Description="GPC Key Retrieval. ">
> <IMembershipCondition class="UrlMembershipCondition"
> version="1"
> URL="C:\Program Files\Microsoft SQL
> Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
> </CodeGroup>
> After adding these two entries to rssrvpolicy.config, when I try to access
> the Reporting Services home page, I get the message "Unable to communicate
> with report server. Please verify that the report server is operational."
> After some experimentation, I found that if I remove the new code group
> section, then the Reporting Services home page will come up fine. So there is
> something wrong with the format or placement of the new code group section,
> but I can't figure out what. The full rssrvpolicy.config file is listed
> below. Please help, thanks.
>
> <configuration>
> <mscorlib>
> <security>
> <policy>
> <PolicyLevel version="1">
> <SecurityClasses>
> <SecurityClass Name="AllMembershipCondition"
> Description="System.Security.Policy.AllMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="AspNetHostingPermission"
> Description="System.Web.AspNetHostingPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="DnsPermission"
> Description="System.Net.DnsPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="EnvironmentPermission"
> Description="System.Security.Permissions.EnvironmentPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="FileIOPermission"
> Description="System.Security.Permissions.FileIOPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="FirstMatchCodeGroup"
> Description="System.Security.Policy.FirstMatchCodeGroup, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="IsolatedStorageFilePermission"
> Description="System.Security.Permissions.IsolatedStorageFilePermission,
> mscorlib, Version=1.0.5000.0, Culture=neutral,
> PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="NamedPermissionSet"
> Description="System.Security.NamedPermissionSet"/>
> <SecurityClass Name="PrintingPermission"
> Description="System.Drawing.Printing.PrintingPermission, System.Drawing,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
> <SecurityClass Name="ReflectionPermission"
> Description="System.Security.Permissions.ReflectionPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="RegistryPermission"
> Description="System.Security.Permissions.RegistryPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="SecurityPermission"
> Description="System.Security.Permissions.SecurityPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="SocketPermission"
> Description="System.Net.SocketPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="SqlClientPermission"
> Description="System.Data.SqlClient.SqlClientPermission, System.Data,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="StrongNameMembershipCondition"
> Description="System.Security.Policy.StrongNameMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="UnionCodeGroup"
> Description="System.Security.Policy.UnionCodeGroup, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="UrlMembershipCondition"
> Description="System.Security.Policy.UrlMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="WebPermission"
> Description="System.Net.WebPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="ZoneMembershipCondition"
> Description="System.Security.Policy.ZoneMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> </SecurityClasses>
> <NamedPermissionSets>
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Unrestricted="true"
> Name="FullTrust"
> Description="Allows full access to all
> resources"
> />
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="Nothing"
> Description="Denies all resources, including
> the right to execute"
> />
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="Execution">
> <IPermission
> class="SecurityPermission"
> version="1"
> Flags="Execution"
> />
> </PermissionSet>
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="GPCRegistryPermissionSet">
> <IPermission class="RegistryPermission"
> version="1"
> Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
> />
> <IPermission
> class="SecurityPermission"
> version="1"
> Flags="Execution, Assertion"
> />
> </PermissionSet>
> </NamedPermissionSets>
> <CodeGroup
> class="FirstMatchCodeGroup"
> version="1"
> PermissionSetName="Nothing">
> <IMembershipCondition
> class="AllMembershipCondition"
> version="1"
> />
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="Execution"
> Name="Report_Expressions_Default_Permissions"
> Description="This code group grants default
> permissions for code in report expressions and Code element. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100512C8E872E28569E733BCB123794DAB55111A0570B3B3D4DE3794153DEA5EFB7C3FEA9F2D8236CFF320C4FD0EAD5F677880BF6C181F296C751C5F6E65B04D3834C02F792FEE0FE452915D44AFE74A0C27E0D8E4B8D04EC52A8E281E01FF47E7D694E6C7275A09AFCBFD8CC82705A06B20FD6EF61EBBA6873E29C8C0F2CAEDDA2"
> />
> </CodeGroup>
> <CodeGroup
> class="FirstMatchCodeGroup"
> version="1"
> PermissionSetName="Execution"
> Description="This code group grants
> MyComputer code Execution permission. ">
> <IMembershipCondition
> class="ZoneMembershipCondition"
> version="1"
> Zone="MyComputer" />
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Microsoft_Strong_Name"
> Description="This code group grants code
> signed with the Microsoft strong name full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Ecma_Strong_Name"
> Description="This code group grants code
> signed with the ECMA strong name full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="00000000000000000400000000000000"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Report_Server_Strong_Name"
> Description="This code group grants
> Report Server code full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100272736AD6E5F9586BAC2D531EABC3ACC666C2F8EC879FA94F8F7B0327D2FF2ED523448F83C3D5C5DD2DFC7BC99C5286B2C125117BF5CBE242B9D41750732B2BDFFE649C6EFB8E5526D526FDD130095ECDB7BF210809C6CDAD8824FAA9AC0310AC3CBA2AA0523567B2DFA7FE250B30FACBD62D4EC99B94AC47C7D3B28F1F6E4C8"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Dundas_Strong_Name"
> Description="This code group grants
> Dundas assemblies. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010043D98F8A9067EF3BCD442ADE2DD48CC6A6FACBCEB1C42DE2847B0A464096C02EEBF6FD87E3889BEED32B9ABD1525A11A282232CD4C46CC8123F8CC08A113CD435429646220969FF4447348D1C21874670834C7A7E89EA8956FC00E0F84FD3DF6FB3EBF21774438AF9E760414FDE06BC2C3AF35FF3DD87578630ED13FE12CBDBC"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust">
> <IMembershipCondition
> class="UrlMembershipCondition"
> version="1"
> Url="$CodeGen$/*"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="SharePoint_Server_Strong_Name"
> Description="This code group grants
> SharePoint Server code full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100AFD4A0E7724151D5DD52CB23A30DED7C0091CC01CFE94B2BCD85B3F4EEE3C4D8F6417BFF763763A996D6B2DFC1E7C29BCFB8299779DF8785CDE2C168CEEE480E570725F2468E782A9C2401302CF6DC17E119118ED2011937BAE9698357AD21E8B6DFB40475D16E87EB03C744A5D32899A0DBC596A6B2CFA1E509BE5FBD09FACF"
> />
> </CodeGroup>
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName=" GPCRegistryPermissionSet"
> Name="GPCCodeGroup"
> Description="GPC Key Retrieval. ">
> <IMembershipCondition class="UrlMembershipCondition"
> version="1"
> URL="C:\Program Files\Microsoft SQL
> Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
> </CodeGroup>
> </CodeGroup>
> </PolicyLevel>
> </policy>
> </security>
> </mscorlib>
> </configuration>
>
can read from the registry. I added a new permission set like this:
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="GPCRegistryPermissionSet">
<IPermission class="RegistryPermission"
version="1"
Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
/>
<IPermission
class="SecurityPermission"
version="1"
Flags="Execution, Assertion"
/>
</PermissionSet>
I added a new code group like this:
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName=" GPCRegistryPermissionSet"
Name="GPCCodeGroup"
Description="GPC Key Retrieval. ">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
URL="C:\Program Files\Microsoft SQL
Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
</CodeGroup>
After adding these two entries to rssrvpolicy.config, when I try to access
the Reporting Services home page, I get the message "Unable to communicate
with report server. Please verify that the report server is operational."
After some experimentation, I found that if I remove the new code group
section, then the Reporting Services home page will come up fine. So there is
something wrong with the format or placement of the new code group section,
but I can't figure out what. The full rssrvpolicy.config file is listed
below. Please help, thanks.
<configuration>
<mscorlib>
<security>
<policy>
<PolicyLevel version="1">
<SecurityClasses>
<SecurityClass Name="AllMembershipCondition"
Description="System.Security.Policy.AllMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="AspNetHostingPermission"
Description="System.Web.AspNetHostingPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="DnsPermission"
Description="System.Net.DnsPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="EnvironmentPermission"
Description="System.Security.Permissions.EnvironmentPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="FileIOPermission"
Description="System.Security.Permissions.FileIOPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="FirstMatchCodeGroup"
Description="System.Security.Policy.FirstMatchCodeGroup, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="IsolatedStorageFilePermission"
Description="System.Security.Permissions.IsolatedStorageFilePermission,
mscorlib, Version=1.0.5000.0, Culture=neutral,
PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="NamedPermissionSet"
Description="System.Security.NamedPermissionSet"/>
<SecurityClass Name="PrintingPermission"
Description="System.Drawing.Printing.PrintingPermission, System.Drawing,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
<SecurityClass Name="ReflectionPermission"
Description="System.Security.Permissions.ReflectionPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="RegistryPermission"
Description="System.Security.Permissions.RegistryPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="SecurityPermission"
Description="System.Security.Permissions.SecurityPermission, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="SocketPermission"
Description="System.Net.SocketPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="SqlClientPermission"
Description="System.Data.SqlClient.SqlClientPermission, System.Data,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="StrongNameMembershipCondition"
Description="System.Security.Policy.StrongNameMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="UnionCodeGroup"
Description="System.Security.Policy.UnionCodeGroup, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="UrlMembershipCondition"
Description="System.Security.Policy.UrlMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="WebPermission"
Description="System.Net.WebPermission, System, Version=1.0.5000.0,
Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
<SecurityClass Name="ZoneMembershipCondition"
Description="System.Security.Policy.ZoneMembershipCondition, mscorlib,
Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
</SecurityClasses>
<NamedPermissionSets>
<PermissionSet
class="NamedPermissionSet"
version="1"
Unrestricted="true"
Name="FullTrust"
Description="Allows full access to all
resources"
/>
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="Nothing"
Description="Denies all resources, including
the right to execute"
/>
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="Execution">
<IPermission
class="SecurityPermission"
version="1"
Flags="Execution"
/>
</PermissionSet>
<PermissionSet
class="NamedPermissionSet"
version="1"
Name="GPCRegistryPermissionSet">
<IPermission class="RegistryPermission"
version="1"
Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
/>
<IPermission
class="SecurityPermission"
version="1"
Flags="Execution, Assertion"
/>
</PermissionSet>
</NamedPermissionSets>
<CodeGroup
class="FirstMatchCodeGroup"
version="1"
PermissionSetName="Nothing">
<IMembershipCondition
class="AllMembershipCondition"
version="1"
/>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="Execution"
Name="Report_Expressions_Default_Permissions"
Description="This code group grants default
permissions for code in report expressions and Code element. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100512C8E872E28569E733BCB123794DAB55111A0570B3B3D4DE3794153DEA5EFB7C3FEA9F2D8236CFF320C4FD0EAD5F677880BF6C181F296C751C5F6E65B04D3834C02F792FEE0FE452915D44AFE74A0C27E0D8E4B8D04EC52A8E281E01FF47E7D694E6C7275A09AFCBFD8CC82705A06B20FD6EF61EBBA6873E29C8C0F2CAEDDA2"
/>
</CodeGroup>
<CodeGroup
class="FirstMatchCodeGroup"
version="1"
PermissionSetName="Execution"
Description="This code group grants
MyComputer code Execution permission. ">
<IMembershipCondition
class="ZoneMembershipCondition"
version="1"
Zone="MyComputer" />
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Microsoft_Strong_Name"
Description="This code group grants code
signed with the Microsoft strong name full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Ecma_Strong_Name"
Description="This code group grants code
signed with the ECMA strong name full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="00000000000000000400000000000000"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Report_Server_Strong_Name"
Description="This code group grants
Report Server code full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100272736AD6E5F9586BAC2D531EABC3ACC666C2F8EC879FA94F8F7B0327D2FF2ED523448F83C3D5C5DD2DFC7BC99C5286B2C125117BF5CBE242B9D41750732B2BDFFE649C6EFB8E5526D526FDD130095ECDB7BF210809C6CDAD8824FAA9AC0310AC3CBA2AA0523567B2DFA7FE250B30FACBD62D4EC99B94AC47C7D3B28F1F6E4C8"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="Dundas_Strong_Name"
Description="This code group grants
Dundas assemblies. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010043D98F8A9067EF3BCD442ADE2DD48CC6A6FACBCEB1C42DE2847B0A464096C02EEBF6FD87E3889BEED32B9ABD1525A11A282232CD4C46CC8123F8CC08A113CD435429646220969FF4447348D1C21874670834C7A7E89EA8956FC00E0F84FD3DF6FB3EBF21774438AF9E760414FDE06BC2C3AF35FF3DD87578630ED13FE12CBDBC"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust">
<IMembershipCondition
class="UrlMembershipCondition"
version="1"
Url="$CodeGen$/*"
/>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName="FullTrust"
Name="SharePoint_Server_Strong_Name"
Description="This code group grants
SharePoint Server code full trust. ">
<IMembershipCondition
class="StrongNameMembershipCondition"
version="1"
PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100AFD4A0E7724151D5DD52CB23A30DED7C0091CC01CFE94B2BCD85B3F4EEE3C4D8F6417BFF763763A996D6B2DFC1E7C29BCFB8299779DF8785CDE2C168CEEE480E570725F2468E782A9C2401302CF6DC17E119118ED2011937BAE9698357AD21E8B6DFB40475D16E87EB03C744A5D32899A0DBC596A6B2CFA1E509BE5FBD09FACF"
/>
</CodeGroup>
</CodeGroup>
<CodeGroup
class="UnionCodeGroup"
version="1"
PermissionSetName=" GPCRegistryPermissionSet"
Name="GPCCodeGroup"
Description="GPC Key Retrieval. ">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
URL="C:\Program Files\Microsoft SQL
Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
</CodeGroup>
</CodeGroup>
</PolicyLevel>
</policy>
</security>
</mscorlib>
</configuration>I managed to figure out the solution. I didn't have the syntax for the code
group quite right. The correct format should be:
<CodeGroup class="UnionCodeGroup"
version="1"
PermissionSetName="GPCRegistry"
Name="GPC_Reports"
Description="Custom Assemblies for GPC
Reports">
<IMembershipCondition class="UrlMembershipCondition"
version="1"
Url="file://C:/Program
Files/Microsoft SQL Server/MSSQL/Reporting
Services/ReportServer/bin/gpc.crypto.dll"/>
</CodeGroup>
I also discovered that editing policy files by hand is the hard way. (I
haven't had much experience with code access security.)
The easier way is to use the GUI tool mscorcfg.msc and make changes to the
the Machine policy file. Then, cut and paste the changes
from security.config to rssrvpolicy.config. Be sure to make a backup copy of
the .config files before making any changes. You can also access
the GUI tool via the Microsoft .NET Framework 1.1 Configuration shortcut in
Administrative Tools.
BTW - in the code remember to include the correct security attributes like so:
[RegistryPermissionAttribute(SecurityAction.Assert,
Read=@." HKEY_LOCAL_MACHINE\SOFTWARE\GPC")]
public static string getEncryptionKey()
{
.
.
.
"Joel Daniels" wrote:
> I am attempting to customize code access security so that a custom assembly
> can read from the registry. I added a new permission set like this:
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="GPCRegistryPermissionSet">
> <IPermission class="RegistryPermission"
> version="1"
> Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
> />
> <IPermission
> class="SecurityPermission"
> version="1"
> Flags="Execution, Assertion"
> />
> </PermissionSet>
> I added a new code group like this:
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName=" GPCRegistryPermissionSet"
> Name="GPCCodeGroup"
> Description="GPC Key Retrieval. ">
> <IMembershipCondition class="UrlMembershipCondition"
> version="1"
> URL="C:\Program Files\Microsoft SQL
> Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
> </CodeGroup>
> After adding these two entries to rssrvpolicy.config, when I try to access
> the Reporting Services home page, I get the message "Unable to communicate
> with report server. Please verify that the report server is operational."
> After some experimentation, I found that if I remove the new code group
> section, then the Reporting Services home page will come up fine. So there is
> something wrong with the format or placement of the new code group section,
> but I can't figure out what. The full rssrvpolicy.config file is listed
> below. Please help, thanks.
>
> <configuration>
> <mscorlib>
> <security>
> <policy>
> <PolicyLevel version="1">
> <SecurityClasses>
> <SecurityClass Name="AllMembershipCondition"
> Description="System.Security.Policy.AllMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="AspNetHostingPermission"
> Description="System.Web.AspNetHostingPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="DnsPermission"
> Description="System.Net.DnsPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="EnvironmentPermission"
> Description="System.Security.Permissions.EnvironmentPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="FileIOPermission"
> Description="System.Security.Permissions.FileIOPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="FirstMatchCodeGroup"
> Description="System.Security.Policy.FirstMatchCodeGroup, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="IsolatedStorageFilePermission"
> Description="System.Security.Permissions.IsolatedStorageFilePermission,
> mscorlib, Version=1.0.5000.0, Culture=neutral,
> PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="NamedPermissionSet"
> Description="System.Security.NamedPermissionSet"/>
> <SecurityClass Name="PrintingPermission"
> Description="System.Drawing.Printing.PrintingPermission, System.Drawing,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a"/>
> <SecurityClass Name="ReflectionPermission"
> Description="System.Security.Permissions.ReflectionPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="RegistryPermission"
> Description="System.Security.Permissions.RegistryPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="SecurityPermission"
> Description="System.Security.Permissions.SecurityPermission, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="SocketPermission"
> Description="System.Net.SocketPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="SqlClientPermission"
> Description="System.Data.SqlClient.SqlClientPermission, System.Data,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="StrongNameMembershipCondition"
> Description="System.Security.Policy.StrongNameMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="UnionCodeGroup"
> Description="System.Security.Policy.UnionCodeGroup, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="UrlMembershipCondition"
> Description="System.Security.Policy.UrlMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="WebPermission"
> Description="System.Net.WebPermission, System, Version=1.0.5000.0,
> Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> <SecurityClass Name="ZoneMembershipCondition"
> Description="System.Security.Policy.ZoneMembershipCondition, mscorlib,
> Version=1.0.5000.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>
> </SecurityClasses>
> <NamedPermissionSets>
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Unrestricted="true"
> Name="FullTrust"
> Description="Allows full access to all
> resources"
> />
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="Nothing"
> Description="Denies all resources, including
> the right to execute"
> />
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="Execution">
> <IPermission
> class="SecurityPermission"
> version="1"
> Flags="Execution"
> />
> </PermissionSet>
> <PermissionSet
> class="NamedPermissionSet"
> version="1"
> Name="GPCRegistryPermissionSet">
> <IPermission class="RegistryPermission"
> version="1"
> Read=" HKEY_LOCAL_MACHINE\SOFTWARE\GPC"
> />
> <IPermission
> class="SecurityPermission"
> version="1"
> Flags="Execution, Assertion"
> />
> </PermissionSet>
> </NamedPermissionSets>
> <CodeGroup
> class="FirstMatchCodeGroup"
> version="1"
> PermissionSetName="Nothing">
> <IMembershipCondition
> class="AllMembershipCondition"
> version="1"
> />
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="Execution"
> Name="Report_Expressions_Default_Permissions"
> Description="This code group grants default
> permissions for code in report expressions and Code element. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100512C8E872E28569E733BCB123794DAB55111A0570B3B3D4DE3794153DEA5EFB7C3FEA9F2D8236CFF320C4FD0EAD5F677880BF6C181F296C751C5F6E65B04D3834C02F792FEE0FE452915D44AFE74A0C27E0D8E4B8D04EC52A8E281E01FF47E7D694E6C7275A09AFCBFD8CC82705A06B20FD6EF61EBBA6873E29C8C0F2CAEDDA2"
> />
> </CodeGroup>
> <CodeGroup
> class="FirstMatchCodeGroup"
> version="1"
> PermissionSetName="Execution"
> Description="This code group grants
> MyComputer code Execution permission. ">
> <IMembershipCondition
> class="ZoneMembershipCondition"
> version="1"
> Zone="MyComputer" />
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Microsoft_Strong_Name"
> Description="This code group grants code
> signed with the Microsoft strong name full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010007D1FA57C4AED9F0A32E84AA0FAEFD0DE9E8FD6AEC8F87FB03766C834C99921EB23BE79AD9D5DCC1DD9AD236132102900B723CF980957FC4E177108FC607774F29E8320E92EA05ECE4E821C0A5EFE8F1645C4C0C93C1AB99285D622CAA652C1DFAD63D745D6F2DE5F17E5EAF0FC4963D261C8A12436518206DC093344D5AD293"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Ecma_Strong_Name"
> Description="This code group grants code
> signed with the ECMA strong name full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="00000000000000000400000000000000"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Report_Server_Strong_Name"
> Description="This code group grants
> Report Server code full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100272736AD6E5F9586BAC2D531EABC3ACC666C2F8EC879FA94F8F7B0327D2FF2ED523448F83C3D5C5DD2DFC7BC99C5286B2C125117BF5CBE242B9D41750732B2BDFFE649C6EFB8E5526D526FDD130095ECDB7BF210809C6CDAD8824FAA9AC0310AC3CBA2AA0523567B2DFA7FE250B30FACBD62D4EC99B94AC47C7D3B28F1F6E4C8"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="Dundas_Strong_Name"
> Description="This code group grants
> Dundas assemblies. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="002400000480000094000000060200000024000052534131000400000100010043D98F8A9067EF3BCD442ADE2DD48CC6A6FACBCEB1C42DE2847B0A464096C02EEBF6FD87E3889BEED32B9ABD1525A11A282232CD4C46CC8123F8CC08A113CD435429646220969FF4447348D1C21874670834C7A7E89EA8956FC00E0F84FD3DF6FB3EBF21774438AF9E760414FDE06BC2C3AF35FF3DD87578630ED13FE12CBDBC"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust">
> <IMembershipCondition
> class="UrlMembershipCondition"
> version="1"
> Url="$CodeGen$/*"
> />
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName="FullTrust"
> Name="SharePoint_Server_Strong_Name"
> Description="This code group grants
> SharePoint Server code full trust. ">
> <IMembershipCondition
> class="StrongNameMembershipCondition"
> version="1"
> PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100AFD4A0E7724151D5DD52CB23A30DED7C0091CC01CFE94B2BCD85B3F4EEE3C4D8F6417BFF763763A996D6B2DFC1E7C29BCFB8299779DF8785CDE2C168CEEE480E570725F2468E782A9C2401302CF6DC17E119118ED2011937BAE9698357AD21E8B6DFB40475D16E87EB03C744A5D32899A0DBC596A6B2CFA1E509BE5FBD09FACF"
> />
> </CodeGroup>
> </CodeGroup>
> <CodeGroup
> class="UnionCodeGroup"
> version="1"
> PermissionSetName=" GPCRegistryPermissionSet"
> Name="GPCCodeGroup"
> Description="GPC Key Retrieval. ">
> <IMembershipCondition class="UrlMembershipCondition"
> version="1"
> URL="C:\Program Files\Microsoft SQL
> Server\MSSQL\Reporting Services\ReportServer\bin\gpc.crypto.dll" />
> </CodeGroup>
> </CodeGroup>
> </PolicyLevel>
> </policy>
> </security>
> </mscorlib>
> </configuration>
>
Saturday, February 25, 2012
CmdExec jobs run in non-admin Windows accounts
I am attempting to tighten the security of our MSSQL environment in a number
of ways and one of these is to run scheduled CmdExec jobs via a non-admin
Windows account. Alas, I cannot get this to work correctly.
I created a credential "abc_job" based on a non-admin Windows domain account
"dom01\abc" in a global group.
I assigned permission for "log on as a batch job" to the global group.
I created a proxy "abc_prox", assigned it to the credential and set it to
active for CmdExec.
I gave access to the proxy for a MSSQL account "xyz" (non sysadmin).
I created a test job and gave ownership of the job to the "xyz" MSSQL account.
The job only has one step and the step runs as proxy "abc_prox".
The job is one line: g:\hjk\test.bat > g:\hjk\test.out
The batch file consists of 5 lines:
chdir /D g:\hjk
whoami
net time
ping gh234test
dir
When I start the job, only the chdir and dir commands succeed. The other 3
lines return "access is denied". However when I remote term to the SQL
Server machine as "dom01\abc" and run the batch file in a command prompt
window it succeeds.
What am I missing?forgot to mention, I also assigned the "xyz" MSSQL account to the
SQLAgentUserRole in the msdb database.
of ways and one of these is to run scheduled CmdExec jobs via a non-admin
Windows account. Alas, I cannot get this to work correctly.
I created a credential "abc_job" based on a non-admin Windows domain account
"dom01\abc" in a global group.
I assigned permission for "log on as a batch job" to the global group.
I created a proxy "abc_prox", assigned it to the credential and set it to
active for CmdExec.
I gave access to the proxy for a MSSQL account "xyz" (non sysadmin).
I created a test job and gave ownership of the job to the "xyz" MSSQL account.
The job only has one step and the step runs as proxy "abc_prox".
The job is one line: g:\hjk\test.bat > g:\hjk\test.out
The batch file consists of 5 lines:
chdir /D g:\hjk
whoami
net time
ping gh234test
dir
When I start the job, only the chdir and dir commands succeed. The other 3
lines return "access is denied". However when I remote term to the SQL
Server machine as "dom01\abc" and run the batch file in a command prompt
window it succeeds.
What am I missing?forgot to mention, I also assigned the "xyz" MSSQL account to the
SQLAgentUserRole in the msdb database.
CmdExec jobs run in non-admin Windows accounts
I am attempting to tighten the security of our MSSQL environment in a number
of ways and one of these is to run scheduled CmdExec jobs via a non-admin
Windows account. Alas, I cannot get this to work correctly.
I created a credential "abc_job" based on a non-admin Windows domain account
"dom01\abc" in a global group.
I assigned permission for "log on as a batch job" to the global group.
I created a proxy "abc_prox", assigned it to the credential and set it to
active for CmdExec.
I gave access to the proxy for a MSSQL account "xyz" (non sysadmin).
I created a test job and gave ownership of the job to the "xyz" MSSQL accoun
t.
The job only has one step and the step runs as proxy "abc_prox".
The job is one line: g:\hjk\test.bat > g:\hjk\test.out
The batch file consists of 5 lines:
chdir /D g:\hjk
whoami
net time
ping gh234test
dir
When I start the job, only the chdir and dir commands succeed. The other 3
lines return "access is denied". However when I remote term to the SQL
Server machine as "dom01\abc" and run the batch file in a command prompt
window it succeeds.
What am I missing?forgot to mention, I also assigned the "xyz" MSSQL account to the
SQLAgentUserRole in the msdb database.
of ways and one of these is to run scheduled CmdExec jobs via a non-admin
Windows account. Alas, I cannot get this to work correctly.
I created a credential "abc_job" based on a non-admin Windows domain account
"dom01\abc" in a global group.
I assigned permission for "log on as a batch job" to the global group.
I created a proxy "abc_prox", assigned it to the credential and set it to
active for CmdExec.
I gave access to the proxy for a MSSQL account "xyz" (non sysadmin).
I created a test job and gave ownership of the job to the "xyz" MSSQL accoun
t.
The job only has one step and the step runs as proxy "abc_prox".
The job is one line: g:\hjk\test.bat > g:\hjk\test.out
The batch file consists of 5 lines:
chdir /D g:\hjk
whoami
net time
ping gh234test
dir
When I start the job, only the chdir and dir commands succeed. The other 3
lines return "access is denied". However when I remote term to the SQL
Server machine as "dom01\abc" and run the batch file in a command prompt
window it succeeds.
What am I missing?forgot to mention, I also assigned the "xyz" MSSQL account to the
SQLAgentUserRole in the msdb database.
CmdExec jobs run in non-admin Windows accounts
I am attempting to tighten the security of our MSSQL environment in a number
of ways and one of these is to run scheduled CmdExec jobs via a non-admin
Windows account. Alas, I cannot get this to work correctly.
I created a credential "abc_job" based on a non-admin Windows domain account
"dom01\abc" in a global group.
I assigned permission for "log on as a batch job" to the global group.
I created a proxy "abc_prox", assigned it to the credential and set it to
active for CmdExec.
I gave access to the proxy for a MSSQL account "xyz" (non sysadmin).
I created a test job and gave ownership of the job to the "xyz" MSSQL account.
The job only has one step and the step runs as proxy "abc_prox".
The job is one line: g:\hjk\test.bat > g:\hjk\test.out
The batch file consists of 5 lines:
chdir /D g:\hjk
whoami
net time
ping gh234test
dir
When I start the job, only the chdir and dir commands succeed. The other 3
lines return "access is denied". However when I remote term to the SQL
Server machine as "dom01\abc" and run the batch file in a command prompt
window it succeeds.
What am I missing?
forgot to mention, I also assigned the "xyz" MSSQL account to the
SQLAgentUserRole in the msdb database.
of ways and one of these is to run scheduled CmdExec jobs via a non-admin
Windows account. Alas, I cannot get this to work correctly.
I created a credential "abc_job" based on a non-admin Windows domain account
"dom01\abc" in a global group.
I assigned permission for "log on as a batch job" to the global group.
I created a proxy "abc_prox", assigned it to the credential and set it to
active for CmdExec.
I gave access to the proxy for a MSSQL account "xyz" (non sysadmin).
I created a test job and gave ownership of the job to the "xyz" MSSQL account.
The job only has one step and the step runs as proxy "abc_prox".
The job is one line: g:\hjk\test.bat > g:\hjk\test.out
The batch file consists of 5 lines:
chdir /D g:\hjk
whoami
net time
ping gh234test
dir
When I start the job, only the chdir and dir commands succeed. The other 3
lines return "access is denied". However when I remote term to the SQL
Server machine as "dom01\abc" and run the batch file in a command prompt
window it succeeds.
What am I missing?
forgot to mention, I also assigned the "xyz" MSSQL account to the
SQLAgentUserRole in the msdb database.
Friday, February 24, 2012
Clustering, Security, Performance, Load Balance
I think this question has been asked number of times. However, I am
looking for some specific information. Perhaps some of you can help
close the gap. Or perhaps you can point me towards right direction.
What sort of clustering do you have in mind? Clustering in MS SQL
Server is all about high availablility. That is two or more machines
that share disk. If one machine dies, another in the machine in the
cluster can take over very quickly.
Yes, there are security features in MS SQL Server. :-)
You can encrypt data in SQL 2005, and you can also use SSL for
encrypting the connection.
I'm not sure that I understand these questions. But if they were asked
with a scale-out solution like Oracle's RAC in mind, they are not
applicable to SQL Server.
>
>
>
What sort of clustering do you have in mind? Clustering in MS SQL
Server is all about high availablility. That is two or more machines
that share disk. If one machine dies, another in the machine in the
cluster can take over very quickly.
>
I know that in other products, clustering is about scalinng out, but
MS SQL Server does not offering anything like that.
>
>
Yes, there are security features in MS SQL Server. :-)
>
>
You can encrypt data in SQL 2005, and you can also use SSL for
encrypting the connection.
>
>
I'm not sure that I understand these questions. But if they were asked
with a scale-out solution like Oracle's RAC in mind, they are not
applicable to SQL Server.
>
--
Erland Sommarskog, SQL Server MVP, esq...@.sommarskog.se
>
Books Online for SQL Server 2005 athttp://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books...
Books Online for SQL Server 2000 athttp://www.microsoft.com/sql/prodinfo/previousversions/books.mspx
How does the database perform and what is the criteria for the
performance matrix? To clarify, how will one collect performance data
related to MS-SQLserver? What is the criteria for collecting such
data?|||Manish (marora@.gmail.com) writes:
You can use performance counters, Profiler, query dynamic management views.
I'm afraid that I can't answer why you would like to collect some data.
Or I am not understanding your question.
looking for some specific information. Perhaps some of you can help
close the gap. Or perhaps you can point me towards right direction.
Perhaps this group can help me fill in ms-sqlserver related following
questions.
1. Do this database have data Clustering capabilities?
1a. If yes, what mechanism is used such as shared disk, share nothing,
etc.
2. Do these dB have Security features?
2a. If yes, what security features are supported? For instance do they
support encryption or SSL connection?
3. How does the database perform and what is the criteria for the
performance matrix?
4. Do they have inbuilt load balance capabilities?
I want to thank everyone for taking your time to read this
correspondence. I will also greatly appreciate your efforts in sharing
your thoughts.
Regards,
ManishManish (marora@.gmail.com) writes:
Quote:
Originally Posted by
I think this question has been asked number of times. However, I am
looking for some specific information. Perhaps some of you can help
close the gap. Or perhaps you can point me towards right direction.
>
Perhaps this group can help me fill in ms-sqlserver related following
questions.
>
1. Do this database have data Clustering capabilities?
1a. If yes, what mechanism is used such as shared disk, share nothing,
etc.
What sort of clustering do you have in mind? Clustering in MS SQL
Server is all about high availablility. That is two or more machines
that share disk. If one machine dies, another in the machine in the
cluster can take over very quickly.
I know that in other products, clustering is about scalinng out, but
MS SQL Server does not offering anything like that.
Quote:
Originally Posted by
2. Do these dB have Security features?
Yes, there are security features in MS SQL Server. :-)
Quote:
Originally Posted by
2a. If yes, what security features are supported? For instance do they
support encryption or SSL connection?
You can encrypt data in SQL 2005, and you can also use SSL for
encrypting the connection.
Quote:
Originally Posted by
3. How does the database perform and what is the criteria for the
performance matrix?
4. Do they have inbuilt load balance capabilities?
I'm not sure that I understand these questions. But if they were asked
with a scale-out solution like Oracle's RAC in mind, they are not
applicable to SQL Server.
--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx|||On Nov 27, 5:38 pm, Erland Sommarskog <esq...@.sommarskog.sewrote:
Quote:
Originally Posted by
Manish (mar...@.gmail.com) writes:
Quote:
Originally Posted by
I think this question has been asked number of times. However, I am
looking for some specific information. Perhaps some of you can help
close the gap. Or perhaps you can point me towards right direction.
>
Quote:
Originally Posted by
Perhaps this group can help me fill in ms-sqlserver related following
questions.
>
Quote:
Originally Posted by
1. Do this database have data Clustering capabilities?
1a. If yes, what mechanism is used such as shared disk, share nothing,
etc.
>
What sort of clustering do you have in mind? Clustering in MS SQL
Server is all about high availablility. That is two or more machines
that share disk. If one machine dies, another in the machine in the
cluster can take over very quickly.
>
I know that in other products, clustering is about scalinng out, but
MS SQL Server does not offering anything like that.
>
Quote:
Originally Posted by
2. Do these dB have Security features?
>
Yes, there are security features in MS SQL Server. :-)
>
Quote:
Originally Posted by
2a. If yes, what security features are supported? For instance do they
support encryption or SSL connection?
>
You can encrypt data in SQL 2005, and you can also use SSL for
encrypting the connection.
>
Quote:
Originally Posted by
3. How does the database perform and what is the criteria for the
performance matrix?
4. Do they have inbuilt load balance capabilities?
>
I'm not sure that I understand these questions. But if they were asked
with a scale-out solution like Oracle's RAC in mind, they are not
applicable to SQL Server.
>
--
Erland Sommarskog, SQL Server MVP, esq...@.sommarskog.se
>
Books Online for SQL Server 2005 athttp://www.microsoft.com/technet/prodtechnol/sql/2005/downloads/books...
Books Online for SQL Server 2000 athttp://www.microsoft.com/sql/prodinfo/previousversions/books.mspx
How does the database perform and what is the criteria for the
performance matrix? To clarify, how will one collect performance data
related to MS-SQLserver? What is the criteria for collecting such
data?|||Manish (marora@.gmail.com) writes:
Quote:
Originally Posted by
How does the database perform and what is the criteria for the
performance matrix? To clarify, how will one collect performance data
related to MS-SQLserver?
You can use performance counters, Profiler, query dynamic management views.
Quote:
Originally Posted by
What is the criteria for collecting such data?
I'm afraid that I can't answer why you would like to collect some data.
Or I am not understanding your question.
--
Erland Sommarskog, SQL Server MVP, esquel@.sommarskog.se
Books Online for SQL Server 2005 at
http://www.microsoft.com/technet/pr...oads/books.mspx
Books Online for SQL Server 2000 at
http://www.microsoft.com/sql/prodin...ions/books.mspx
Subscribe to:
Posts (Atom)