您的位置:首页 > 其它

How to use iBatis/NHibernate in medium trust/partial trust environments like Mosso

2010-12-12 11:31 477 查看

http://programcsharp.com/blog/archive/2009/08/19/ibatis-nhibernate-mosso-medium-trust-partial-trust-environments.aspx

Many shared hosting providers (in this case Mosso) run your ASP.NET applications in a medium trust or modified medium trust environment to reduce security risks. This causes issues with certain techniques and components that require permissions removed by medium trust.

One of the biggest issues other than the actual restriction of permissions is the restriction of partially trusted assemblies calling fully trusted code. By default, if an assembly is strong named, partially trusted assemblies (i.e. the application assemblies in your app running under medium/partial trust) can't call it. This hits many open source components such as iBatis and NHibernate. The workaround to this is to add the AllowPartiallyTrustedCallers assembly level attribute. This will mark the assembly as safe for calling by partially trusted assemblies.

Here is an example of how to modify iBatis to support this:

Download the iBatis source from the iBatis website: http://ibatis.apache.org/dotnet.cgi

Extract the source .zip to a folder

Open the IBatisNet.2005.sln solution in VS.NET

For each project in the solution, open it's AssemblyInfo.cs file
Add this using statement at the top of the file: "using System.Security;"

Add this attribute at the bottom of the file: "[assembly: AllowPartiallyTrustedCallers]"

Right click on the solution and select "Configuration Manager..."

In the "Active solution configuration" dropdown, select Release

Uncheck all of the Test projects

Click OK

Build the solution

Or you can download the compiled assemblies: iBatis-PartialTrust.zip

Enabling NHibernate for medium/partial trust is a similar procedure. If there is enough demand I will present steps and compiled assemblies for it as well.

As for the permission restrictions, most shared hosting providers don't actually run in medium trust as this restricts many useful things such as Reflection etc. One example I've run into recently is Mosso's modified medium trust. They take medium trust, which consists of the following denied permission restrictions:

Call unmanaged code.

Call serviced components.

Write to the event log.

Access Microsoft Message Queuing queues.

Access ODBC, OleDb, or Oracle data sources.

Access files outside the application directory.

Access the registry.

Make network or Web service calls (using the System.Net.HttpWebRequest class, for example).

And then Mosso adds back in the following allowed permission to come up with "modified medium trust":

WebPermission Unrestricted="true"

OleDbPermission Unrestricted="true"

OdbcPermission Unrestricted="true"

SocketPermission Unrestricted="true"

ConfigurationPermission Unrestricted="true"

ReflectionPermission Unrestricted="true"

This is still rather limiting, but at least you can get most things done as long as you can call into the necessary assemblies without getting exceptions as discussed in the workaround section above.

Wednesday, August 19, 2009 4:04 PM
内容来自用户分享和网络整理,不保证内容的准确性,如有侵权内容,可联系管理员处理 点击这里给我发消息
标签: