MSDN Magazine - April 2008 - (Page 52)

Figure 4 CodeAccessSecurityHelper Class public enum StandardPermissionSet { Internet, LocalIntranet, FullTrust, Execution, SkipVerification } public static class CodeAccessSecurityHelper { public static PermissionSet PermissionSetFromStandardSet( StandardPermissionSet standardSet); public static void DemandClientPermissions (this ClientBase proxy) where T : class; public static void DemandAsyncPermissions(); //More members } Figure 5 PermissionState and PermissionSet public void void void void } interface IStackWalk { Assert(); Demand(); Deny(); PermitOnly(); public enum PermissionState { None, Unrestricted } public class PermissionSet : IStackWalk, //More interfaces { public PermissionSet(PermissionState state); public IPermission AddPermission(IPermission permission); public void Assert(); public void Demand(); public static void RevertAssert(); } //More members can also represent the super permission set full trust (which is not really a set of individual permissions; it is more like a single permission). The PermissionSet class supports the IStackWalk interface, which lets you install a stack walk modifier, such as a modifier that stops the demand for the permissions in the permission set by asserting that all callers up the stack have those permissions. The stack walk modifier is removed automatically when the method that installed it returns. You can also explicitly remove it with the static RevertAssert method of PermissionSet. Both the DemandAsyncPermissions and DemandSyncPermissions helper methods of PartialTrustClientBase use corresponding methods on CodeAccessSecurityHelper to perform their demands. The chart in Figure 6 shows the structured demands raised by PartialTrustClientBase .Invoke as a function of the binding used and other aspects of the scenario such as the use of transactions, reliability, certificate store access, diagnostics, callbacks, and asynchronous calls. Analyzing the Demands of Invoke I based the structured demands on a few elements. First, whenever possible, I tried to approximate the raw demands on the client raised by WCF. That said, I did smooth the rough edges of WCF since it was not designed for comprehensive partial-trust use. None of the bindings and scenarios listed in Figure 6 demand full trust or unmanaged code access. There are plenty of places in the Figure 6 Structured Security Demands of PartialTrustClientBase Scenario TCP IPC WS, Basic WS-Dual Permissions Security permission with execution, unrestricted DNS, Socket permission to connect to port on target host Security permission with execution, control policy, and control evidence Security permission with execution and Web permission to connect to URI Security permission with execution and Web permission to connect to URI, and Web permission to accept callbacks to callback address, minimal ASP.NET hosting permission Security permission with execution, MSMQ permission to send to queue Security permission to control policy Security permission to control policy and control evidence MSMQ RM over TCP Duplex over TCP, Asynchronous calls (AsyncPattern), User-name credentials, Message security with service certificate negotiation and without service certificate validation Windows security with interactive user credentials Windows security with alternative credentials Transaction propagation User-name credentials, Message security without service cert negotiation or with service cert validation, Certificate credentials Diagnostic tracing Environment permission to read USERNAME Security permission to control principal Unrestricted distributed transaction permission Store permission to enumerate stores, open store, and enumerate certificates Environment permission to read COMPUTERNAME, File I/O permission to path discovery, append, write to log files 52 msdnmagazine Foundations

Table of Contents Feed for the Digital Edition of MSDN Magazine - April 2008

MSDN Magazine - April 2008 Contents Toolbox CLR Inside Out Basic Instincts Cutting Edge Foundations Test Run Service Station Windows with C++ Going Places { End Bracket }

MSDN Magazine - April 2008

For optimal viewing of this digital publication, please enable JavaScript and then refresh the page. If you would like to try to load the digital publication without using Flash Player detection, please click here.