MSDN Magazine - April 2008 - (Page 51)

Figure 3 Raw WCF Client-Side Security Demands Scenario TCP IPC WS and WS Dual Basic and Web MSMQ Asynchronous calls, Duplex over TCP RM over TCP Windows security with interactive user credentials Windows security with alternative credentials Diagnostic tracing User-name credentials, Message security with service cert negotiation and without service cert validation User-name credentials, TCP message security with service cert negotiation and without service certificate validation Any certificate store access, Transaction propagation User-name credentials, Message security without service certificate negotiation or with service certificate validation, Certificate credentials Permissions Security permission with execution and unmanaged code, unrestricted DNS, socket permission to connect to port on target host Security permission with execution, unmanaged code, control policy, and control evidence Security permission with execution and unmanaged code, Web permission to connect to URI Security permission with execution, Web permission to connect to URI Security permission with execution and unmanaged code Security permission to control policy and evidence Security permission to control policy Environment permission to read USERNAME Security permission to control principal, Environment permission to read USERNAME Security permission with unmanaged code, Environment permission to read COMPUTERNAME Security permission to control policy and evidence, Store permission to enumerate certificates Security permission to control policy and evidence Full trust Full trust are the basic and Web bindings. The WS binding defaults to message security by default, resulting in an unmanaged code access permission demand. As you can see from Figure 3, key aspects of WCF such as transactions, reliable messaging, unlimited message security interaction, and certificate store access all require full trust, thus rendering my prior version of PartialTrustClientBase pointless in a partialtrust environment. Furthermore, demanding unmanaged code access by virtually all non-HTTP bindings (and the WS binding with message security) is unacceptable, negating the very idea of CAS for a partial-trust client. To enable appropriate, secure, and correct use of WCF by a partially trusted client, PartialTrustClientBase offers the Invoke method defined as: protected object Invoke(string operation,params object[] args); Structured Demands with PartialTrustClientBase } public MyContractClient(string endpointName) : base(endpointName) {} public void MyMethod() { Invoke(“MyMethod”); } Invoke accepts the name of the operation to invoke and its parameters in the form of a comma-separated params array of objects. Rather than using the Channel property for invoking the call, Invoke uses reflection. Here is a proxy deriving from PartialTrustClientBase using the Invoke method: public class MyContractClient : PartialTrustClientBase ,IMyContract { public MyContractClient() {} Invoke will first demand the appropriate CAS permissions according to the scenario of the calling client and the target service endpoint. If the client is granted those permissions—that is, no security exception was raised by the demands—Invoke will programmatically assert full trust and proceed to invoke the operation, satisfied that the client has the right permissions to call the service. I call such behavior a structured permission demand. Invoke cannot use an attribute to declaratively assert full trust, since that will mask any more granular permission it demands. Instead, the implementation of Invoke in Figure 2 first checks whether the call is invoked asynchronously (using the AsyncPattern flag of the operation contract). If it is, Invoke demands the appropriate permissions using the DemandAsyncPermissions helper method. Invoke then demands the synchronous permissions using the DemandSyncPermissions helper method. For the call itself, Invoke programmatically asserts full trust using my CodeAccessSecurityHelper class shown in Figure 4. The PermissionSetFromStandardSet method takes my enum value representing one of the standard .NET permission sets and returns the matching instance of PermissionSet (see Figure 5). PermissionSet, as its name implies, is a collection of permissions, but it Foundations april2008 51

Table of Contents Feed for the Digital Edition of MSDN Magazine - April 2008

MSDN Magazine - April 2008 Contents Toolbox CLR Inside Out Basic Instincts Cutting Edge Foundations Test Run Service Station Windows with C++ Going Places { End Bracket }

MSDN Magazine - April 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.