Corey Roth [MVP] : Code Access Security

New level of trust in SharePoint 2013 Preview

CoreyRoth — Mon, 13 Aug 2012 02:37:27 GMT

When it comes to development, the introduction of the application model overshadows many of the other new things happening in SharePoint 2013 development. I noticed one particular change as I was working on a new slide deck regarding the change to the default trust level of a web application. In SharePoint 2007 and SharePoint 2010, the Trust element was set to a value of WSS_Minimal. Effectively what this did was it meant that any DLL deployed to the web application bin folder was untrusted. This meant your code had to either run in the GAC (giving it full trust) or you had to specify Code Access Security (CAS) policies to enable partial trust. CAS policies were quite complicated and most SharePoint developers did not know how to implement them. However, in the 2007 days I was a big fan of them and got many developers started with this blog post and later with this post for SharePoint 2010.

In SharePoint 2013 Preview, this changes. The trust level is now set to Full.

  </providers>
</siteMap>
<trust level="Full" originUrl="" legacyCasModel="true" />
<webParts>
  <transformers>

According to the very little information I have found on the topic this is due to the fact that .NET 4.0 has a new CAS model. The legacyCasModel attribute is set to true to enable previously written code with CAS policies to still function. What this means is that code can now be deployed to the bin folder (which is faster) and it will have the same permissions as if deployed to the GAC. Now what this means from a security stand point is up for debate I am sure. However when Visual Studio 2010 came out everyone started deploying to the GAC any ways since it was just so much easier. In reality, it probably doesn’t affect things much in the scheme of things. Of course if you are developing sandboxed solutions or for the new app model this makes little difference to you. I still thought it was an interesting change.

Slides and Code Samples from SharePoint Saturday Kansas City

CoreyRoth — Wed, 16 Dec 2009 15:58:00 GMT

I had a great time at SharePoint Saturday Kansas City. @MossLover and @SharePointKevin as well as many others did a great job organizing this event. I met a bunch of great new people and I got to see some familiar faces again. I had the privilege of speaking about Code Access Security again using Visual Studio 2010 and SharePoint 2010. As promised, I am posting my slides and code samples from the talk. You can find them at the bottom of this post.

Deploying a Web Part with Code Access Security in Visual Studio 2010 (SP2010)

CoreyRoth — Fri, 20 Nov 2009 20:38:00 GMT

By now, you have heard about how the SharePoint 2010 development experience has been improved. We can easily deploy web parts and other code without having to manually manipulate any XML files. What about under partial trust though? Many of you that know me know that I have pushed using Code Access Security quite a bit through a series of blog posts and talks. So it would be irresponsible of me not to talk about how we can do that in Visual Studio 2010. The good news is that it is a lot easier.

Let’s start by creating a new SharePoint project in Visual Studio 2010 and creating a new Web Part project item. In this case we are talking about deploying a Farm Solution, not a Sandboxed Solution. Note: we are going to talk about a traditional web part today, and not a Visual Web Part. Visual Web Parts are simply not supposed under partial trust. More on that later below. My web part has some simple code which uses ASP.NET and also hits the SharePoint object model to display the title of the site in a label. Here is what the code looks like.

protected override void CreateChildControls()
{
    Controls.Add(new Label(){Text = "<div>My Cool Web Part!</div>"});
    Controls.Add(new Label() { Text = string.Format("Site Title: {0}", SPContext.Current.Web.Title) });
 
    base.CreateChildControls();
}

When you create a new project, it deploys to the GAC by default. We start by changing this on the project properties.

This effectively changes the DeploymentTarget attribute on Assembly element in the Manifest.xml. At this point, you may be asking. “Sweet, is that it? Does it take care of the CAS policy for me?” The answer to that of course is “No.” However, it is quite easy to add it. Let’s see what happens if we try to deploy it as is. I’ll just hit F5 to start debugging. I then add my web part to any existing page, and I immediately get hit with the following in Visual Studio.

System.Security.SecurityException: Request for the permission of type 'Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' failed.

Luckily we know how to fix this. Hopefully, this will also help new developers when they get this error in the future and aren’t sure what to do. We need to grant permissions to this assembly to use the object model as well as a few other things. We’ll start by using a standard set of IPermission elements that I have used in past posts. This gives me basic ASP.NET, SharePoint object model, and Security permissions.

<CodeAccessSecurity>
  <PolicyItem>
    <PermissionSet class="NamedPermissionSet" version="1" Description="Permission set for VisualWebPartProject1.">
      <IPermission class="AspNetHostingPermission" version="1" Level="Minimal" />
      <IPermission class="SecurityPermission" version="1" Flags="Execution,ControlPrincipal,ControlAppDomain,ControlDomainPolicy,ControlEvidence,ControlThread" />
      <IPermission class="Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
                   version="1" ObjectModel="True"  />
      <IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Read="UserName" />
      <IPermission class="System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Read="$AppDir$" Write="$AppDir$" Append="$AppDir$" PathDiscovery="$AppDir$" />
    </PermissionSet>
    <Assemblies>
      <Assembly Name="VisualWebPartProject1"  />
    </Assemblies>
  </PolicyItem>
</CodeAccessSecurity>

You can use this in your code almost exactly but two small changes are required. First, you need to change your assembly name to whatever you have called yours. Secondly, if you look at that SharePointPermission, you’ll notice it says version 12.0.0.0. We need to change this to 14.0.0.0 since we are working with SharePoint 2010 now. Adding this to your package is quite easy. In the Solution Explorer, locate Package and then Package.package and open it. This will bring open the package designer. Click on the Manifest tab at the bottom and then expand Edit Options. The way this works is that you can paste any additional elements here and it will merge your items with the ones it automatically generates. Here is what I would paste in.

<?xml version="1.0" encoding="utf-8"?>
<Solution xmlns="http://schemas.microsoft.com/sharepoint/">
  <CodeAccessSecurity>
    <PolicyItem>
      <PermissionSet class="NamedPermissionSet" version="1" Description="Permission set for VisualWebPartProject1.">
        <IPermission class="AspNetHostingPermission" version="1" Level="Minimal" />
        <IPermission class="SecurityPermission" version="1" Flags="Execution,ControlPrincipal,ControlAppDomain,ControlDomainPolicy,ControlEvidence,ControlThread" />
        <IPermission class="Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c"
                     version="1" ObjectModel="True"  />
        <IPermission class="System.Security.Permissions.EnvironmentPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Read="UserName" />
        <IPermission class="System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" version="1" Read="$AppDir$;C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\14\TEMPLATE\CONTROLTEMPLATES\VisualWebPartProject1" Write="$AppDir$" Append="$AppDir$" PathDiscovery="$AppDir$" />
      </PermissionSet>
      <Assemblies>
        <Assembly Name="VisualWebPartProject1"  />
      </Assemblies>
    </PolicyItem>
  </CodeAccessSecurity>
</Solution>

Here is what it would look like on the screen.

If everything is correct, you will see the merged result up top. If there is an error in your XML, you will also see it there. Now let’s deploy the solution and see if we can add the web part to an existing page.

Unfortunately, this is the error we get and it actually gives us good information. We simply forgot to add the APTCA attribute (or AllowPartiallyTrustedCallers). Just open your AssmeblyInfo.cs file and add the following line.

[assembly: AllowPartiallyTrustedCallers()]

Redeploy your solution and try to add your web part again. If all goes well, you will have a lovely web part on the screen that looks like this.

With the above set of CAS policies, you can probably get most of the code you want to do to work. I mentioned Visual Web Parts above. Here is the issue I am currently seeing. If you remember my post on the Visual Web Part, you will know that this is just a web part with a Page.LoadControl() method calling a User Control (.ascx). Page.LoadControl requires a ton of permissions and I haven’t been able to figure them out. This means, it simply will not work. I posted something to the forums about it. Paul Andrew was nice enough to respond to my post and state that Page.LoadControl simply will not function under partial trust. It has a check in it to verify that it is not running under partial trust. He also goes on to explain this is why you can’t use Visual Web Parts in sandboxed solutions.

This may seem like a lot of steps, but really I just posted a lot of pictures. Trust me it’s a lot fewer steps than it was before in MOSS 2007. Just look at my old post if you don’t believe me. Now, you might ask why would I do this instead of a Sandboxed solution? Sandboxed solutions are severely limited on what they can do with the SharePoint object model. By default, the CAS policy that defines them can’t even connect to a database. I can specify at a per assembly level here what each one can do. That is a big advantage.

Intro to SharePoint Development: How to Build and Deploy a Web Part

CoreyRoth — Wed, 22 Oct 2008 12:50:00 GMT

UPDATE: Building Web Parts in SharePoint 2010

I've recently helped out a number of developers new to SharePoint and I found that I have been often asked the same types of questions. Most of those involve getting started and deployment, so today, I am beginning my series on getting started with SharePoint. Most new developers find starting out pretty overwhelming, but once you get used to it, it does all make sense. Hopefully this post will help the community and keep new SharePoint developers from getting scared off. There have been a lot of posts on this topic I admit. Since there are so many ways to do things, I wanted to write this post as a reference to new developers so they can see how I usually do things. What I find is that most developers have no trouble getting a web part built, but when it comes time to deploy it, they are lost. There are multiple ways to do this and not all of them are necessarily the right way.

Environment

Let's start by talking about your development environment. In an ideal situation, you probably have your own virtual machine with Windows Server 2008 (or 2003), MOSS 2007, and Visual Studio 2008 installed. However, maybe you don't have your own dedicated machine and you are going to be developing on a Windows XP machine, but deploying to a remote SharePoint server. This is fine, but you are going to have to do some things a little differently. First, you won't be able to install the Visual Studio Extensions for SharePoint. You can live without this though because most people I have ran into say they don't use them. Secondly, when it comes to deployment (which we'll talk about down below), you are going to have to copy your source files (either manually or via solution package) to the server. You are also going to have to remote debug but fret not my post on it makes it easy.

If you are developing on a desktop, another thing you will need to do is copy the SharePoint assemblies to your computer. We can easily get these from a deployed SharePoint server. However, this is a great time to take an aside and talk about some of the SharePoint directory structure.

C:\Program Files\Common Files\microsoft shared\Web Server Extensions\12

All SharePoint developers have that file path permanently burned into their memory. It is often referred to as the 12 hive. A lot of things happen within this folder. Subfolders here contain the SharePoint binaries, Master Pages, Application Pages, User Controls, Configuration Files, and Features. Although SharePoint will let you customize any file in here, in general you don't want to make changes to any of these builtin files as it puts you in an unsupported scenario. If you want to customize a master page or a style, it is typically best that you make a copy of what you want to customize and go from there. Here is a quick list of some of the key folders and what they are used for.

Folder	Description
CONFIG	Contains partial trust configuration files
ISAPI	Binaries and SharePoint Web Services
LOGS	Error Logs (look here first when you get a strange error)
TEMPLATE\CONTROLTEMPLATES	User Controls
TEMPLATE\FEATURES	SharePoint Features (turns functionality on and off)
TEMPLATE\IMAGES	MainImages Folder
TEMPLATE\LAYOUTS	Pages and Styles
TEMPLATE\SiteTemplates	Definitions avaiable for deploying new sites
TEMPLATE\THEMES	Used to create custom themes in SharePoint
TEMPLATE\XML	Contains XSDs for any XML used with SharePoint

Enough on that tangent, back to the assemblies that we need to copy. Go to the above path and then go into the ISAPI folder. Copy all of the DLLs from this folder onto your desktop machine in the corresponding folder name. If you don't have that folder, create it. You may also copy them to the Global Assembly Cache as well. Once you are this point, you are ready to being building a web part.

Coding the Web Part

Start by creating a new class library project in Visual Studio. There are packages and tools out there to automate some of these steps, but its best that you learn how to do it first by hand, so you know how to troubleshoot it should something go wrong. Next, you will want to add (at a minimum) a reference to Microsoft.SharePoint.dll. You can either grab it out of the GAC (will be listed under Windows SharePoint Services) or use the copy that you put in your ISAPI folder. After you add it, make sure Copy Local is set to false on your reference. You will also want to add System.Web since more than likely your web part will use an ASP.NET control in it. You are now ready to create your web part. To do this, create a new class and add a using statement for Microsoft.SharePoint. In the past, you would derive your class from Microsoft.SharePoint.WebPart (and you still can), but now the more accepted way of doing things is to derive from the new System.Web.UI.WebParts.WebPart class. The latter comes from ASP.NET 2.0 and can actually be deployed outside of SharePoint. Here is what our class is going to look like.

public class TestWebPart : System.Web.UI.WebControls.WebParts.WebPart
{
    protected override void CreateChildControls()
    {
        base.CreateChildControls();
        Controls.Add(new Label(){Text = "My Test Web Part (Hello World)!"});
    }
}

The content of the class is simple. We use the overridden CreateChildControls method to add ASP.NET controls to the page to do the rendering. I simply call Control.Add and add a Label control with the text above. Compile it and this web part is good to go, but there is the small matter of deploying it. Compiling it yield you a DLL that has be deployed to SharePoint somehow. SharePoint also needs to know where the web part is and how to reference it. This is where the .webpart file comes in.

Describing the WebPart

The .webpart file is an XML file that tells SharePoint what to call your DLL and what assembly it is located in. The easiest way to get started creating this file is to copy another one in SharePoint. You can find plenty of examples by going to your web part gallery (Site Root -> Site Settings -> Web Parts). this file simply describes the class and assembly of your web part as well as some default properties (i.e.: it sets a title and description). You can also add your own properties by specifying a series of attributes on a property in your class.

<webParts>
  <webPart xmlns="http://schemas.microsoft.com/WebPart/v3">
    <metaData>
      <type name="MyWebPart.TestWebPart, MyWebPart, Version=1.0.0.0, Culture=neutral" />
      <importErrorMessage>Cannot import this Web Part.</importErrorMessage>
    </metaData>
    <data>
      <properties>
        <property name="Title" type="string">My Web Part</property>
        <property name="Description" type="string">A test web part.</property>
      </properties>
    </data>
  </webPart>

Note: There is also a .dwp file, which comes from version 2, that can describe your webpart as well. It still works but it is consider deprecated.

Ghetto Deploying

So far, we have built a web part and created a .webpart file so now it is time to deploy it. We'll start by doing it the wrong way. The first thing to know is that you can't just copy your DLL into the bin folder of your web application unless you change to full trust (not recommended) or specify Code Access Security. Specifying CAS when first starting out will make even the most seasoned developers run for the hills. So we are going to start by deploying to the GAC. In almost all situations, I recommend against this, but for the sake of getting you started, it is ok. You can then follow the Code Access Security post later on how to set up everything properly.

Start by copying your compiled DLL into the Global Assembly Cache of your SharePoint server. Keep in mind anytime you update this DLL, you will need to either reset IIS or recycle the application pool (otherwise the old version stays in memory). The next thing you need to do is upload the .webpart file to the web part gallery of your site collection (again Site Root -> Site Settings -> Web Parts). At this point, SharePoint will be able to recognize your web part and it can be added to a page. If you click on the name of the web part in the gallery (in this case MyWebPart.webpart), it will display a preview of what it will look like on a page. If everything is working correctly, you will see your web part, otherwise you will get an error. At this point, you will have the following error.

A web part on this web part page cannot be displayed or imported because it is not registered on this site as safe.

This is because there is one more step to do. Every web part or user control in SharePoint must be registered as safe to execute in the web.config. To do this, find the SafeControls element near the top and add the following line (changing it with your fully qualified assembly path).

<SafeControls>
  <SafeControl Assembly="MyWebPart, Version=1.0.0.0, Culture=neutral" Namespace="MyWebPart" TypeName="*" Safe="True" />
</SafeControls>

Now when you go back to the web part gallery, it should give you a preview of your web part. If it doesn't check your assembly paths and make sure the file is deployed. If you still have issues, check out this post on troubleshooting a web part. Assuming you were able to get the web part to preview, you can also go add it to a page by going to any page, clicking Edit Page and then Add Web Part. Scroll through the list until you find your web part and select it. You should then see your web part on the page.

Features

So we talked about deploying a web part the wrong way. Ok, it's not necessarily wrong, but it really adds a lot of extra work This can be automated quite a bit by using features and solution packages. Creating a feature, allows you to turn on and off customizations to SharePoint at the click of a button. They can be used to deploy web parts, site definitions, workflows, document libraries, and plenty of other things. In this case, we are building a feature to automate the deployment of our .webpart file. You can also specify a class (Feature Receiver) that is executed when the feature is installed, activated, deactivated, or uninstalled. A feature typically consists of two XML files. The first file Feature.xml (must be named that), describes the feature and where its feature receiver is (if any).

<Feature 
    xmlns="http://schemas.microsoft.com/sharepoint/" 
    Id="{BDD425C3-CA50-4aee-9170-73954044D764}" 
    Scope="Site" 
    Hidden="False" 
    Title="My Web Part" 
    Description="My Test Web Part"
    >
  <ElementManifests>
    <ElementManifest Location="Elements.xml" />
  </ElementManifests>
</Feature>

The Id element contains a GUID. Every feature needs a different one. The Scope attribute specifies where to deploy the feature. Possible values are Site, Web, WebApplication, and Farm. I would go into the difference in scopes, because this post is already getting long enough. You will most likely use Site or Web for most things you do (note on terms in API). The ElementManifest element makes calls to additional XML files. Typically the other file is called Elements.xml (although it can be called anything).

The Elements.xml file can be used to deploy files, create document libraries, and many other functions. I won't go into the whole detail of this file (it's in the SDK), but basically we are specifying that the MyWebPart.webpart file should be copied into the web part gallery. I will tell you what a few things are though. In this case the Module element says that we are going to deploy something into a list that is located at _catalogs/wp (this is the URL of the web part gallery). How did I figure this out? I looked at another example. The File element deploys our MyWebPart.webpart file into the web part gallery. I wont go into why you set the Type to GhostableInLibrary right now. Just know this is the value you will pretty much always use.

<Elements xmlns="http://schemas.microsoft.com/sharepoint/">
  <Module Name="WebPartPopulation" List="113" Url="_catalogs/wp" RootWebOnly="TRUE">
    <File Url="MyWebPart.webpart" Type="GhostableInLibrary" />
  </Module>
</Elements>

When the feature is activated, it will put the file in the web part gallery. However, it won't remove the item from the web part gallery on deactivation. It's pretty easy to do with code and I still plan to write a post on it. For now, if you want the .webpart file gone you will have to delete it manually. During the development cycle though, the only time it really is necessary to remove a .webpart file is if you have changed the namespace, class name, or public key token. Here is what an elements file typically looks like for deploying a web part.

So where do all these files go? Let's talk about where you put them in your Visual Studio project first. Typically, what you will do is create a folder structure in your project that matches the 12 hive. So in this case, we will create a TEMPLATE\FEATURES folder. We will then create a folder for our web part. I am just calling it MyWebPart for now. Here is what your solution will look like. This folder is where you will put Feature.xml, Elements.xml, and MyWebPart.webpart.

To deploy the feature, copy it to the TEMPLATE\FEATURES folder in your 12 hive. You then need to use stsadm command to install it. The stsadm executable is located in the bin folder of the 12 hive. You tend to use it a lot, so you might want to put it in your path environment variable. Once you have located it, issue the following command.

stsadm -o installfeature -name MyWebPart

This makes the feature available to be activated. To activate it, go to Site Collection Features (Site Root -> Site Settings -> Site Collection Features). Find the feature in the list and click the Activate button. This deploys the web part to the gallery and it can be added to pages as before. If you ever want to remove the feature, use the uninstallfeature operation. You will want to deactivate the feature first, otherwise you will have to use the -force parameter when using stsadm.

Deploying Via Solution Package

Features are nice, but we can take this one step further. A solution package (.wsp file) allows you to package your entire solution into one .wsp file for deployment. A .wsp file is simply a cab file with a manifest.xml file that tells SharePoint how to install the contents. It will even deploy and install your feature for you, allowing you to skip the installation steps above. Two files are required to build the .wsp file: cab.ddf and manifest.xml. These files typically go into a folder called Solution in your Visual Studio project. Cab.ddf tells the utility, makecab.exe, how to construct the .wsp file. Below is an example DDF file. You will need to set the CabinetNameTemplate to the filename you want for your wsp file. You then specify a source and destination for each file you want copied. In the example below, note that I am copying the DLL, Elements.xml, Feature.xml, and MyWebPart.webpart file.

; ** MyWebPart.wsp **
.OPTION EXPLICIT    ; Generate errors 
.Set CabinetNameTemplate=MyWebPart.wsp
.set DiskDirectoryTemplate=CDROM ; All cabinets go in a single directory
.Set CompressionType=MSZIP;** All files are compressed in cabinet files
.Set UniqueFiles="ON"
.Set Cabinet=on
.Set DiskDirectory1=Package
 
Solution\manifest.xml manifest.xml
 
; binary
bin\debug\MyWebPart.dll MyWebPart.dll
 
; feature files
TEMPLATE\FEATURES\MyWebPart\Elements.xml MyWebPart\Elements.xml
TEMPLATE\FEATURES\MyWebPart\Feature.xml MyWebPart\Feature.xml
 
; web part files
TEMPLATE\FEATURES\MyWebPart\MyWebPart.webpart FEATURES\MyWebPart\MyWebPart.webpart

I won't go into manifest.xml again because I have already covered it once in this post. It's this file that tells SharePoint how to deploy features, copy files, setup code access security, and add SafeControl entries to your web.config. Once you create your solution files, build your project and then go to the command line. The utility makecab.exe (should already be on your system) will actually create the wsp file. In the command prompt, go to the root folder of your project and execute the following command. It has to be executed from that folder because all of the paths are relative.

makecab.exe /f solution\cab.ddf

You can automate this step when you build, by creating a build action.

If you are working on a remote server, you will need to copy the .wsp file onto the server. Add and deploy the solution with the following commands.

stsadm -o addsolution -filename package\MyAssembly.wsp
stsadm -o deploysolution -name MyAssembly.wsp -immediate -allContentUrls -allowGacDeployment
stsadm -o execadmsvcjobs

At this point if all goes well, your solution will be installed and deployed. This eliminates all the steps of manually copying files into SharePoint. You can then activate your feature like before (remember it installs the feature for you) and add your web part to a page. If you make an update to your web part, deploying is easy, just use the upgradesolution stsadm command and it will update all the files in your solution. Should you decide, you don't need the solution any more, use the retractsolution command. After you issue either of those commands, you will need to follow it up with a execadmsvcjobs command as shown above.

This may sound like a lot, but it really isn't bad. It makes deployment really easy (especially to other servers). Once you have your solution deployed and you want to make an update, you can also just directly copy out the binary to your server. Not really a best practice, but it does speed things up quite a bit, since stsadm commands take a few seconds to run.

Once you get the hang of it and are familiar with the deployment process, you really need to consider deploying your solution to the bin folder by deploying your solution under partial trust. Remember right now, you are deploying to the GAC which is not ideal. My post on Code Access Security walks you through the whole process and provides more details on how solution packages are built.

User Controls

By now, you may be thinking, I went through all of that and I still have to render stuff to the screen using straight code? I hear you. It's not any fun at all and can be a controversy among some SharePoint developers. You do have a couple of alternatives, use the SmartPart or write your own. I typically go with the latter. This simple web part uses Page.LoadControl to load the .ascx file you specify.

This is quickly becoming the longest post I have ever written. I've attached the code I used in this post. You can use it to verify that you put your own web part together correctly or you can use it as a starting point. I hope this provides enough information for a new SharePoint developer to get started. I certainly wish I had this much info condensed in one place when I was starting out. You may also want to check out one of the many solution generating tools out there such as stsdev. Please leave a comment if this helps or if you have any questions. If I am missing anything or you think I need to add anything, also please let me know.

Slides and Code Samples from Tulsa TechFest

CoreyRoth — Wed, 08 Oct 2008 15:15:00 GMT

Today, at TechFest, I gave my talk on Implementing Partial Trust in SharePoint and I had a great time. As promised, here are the slides and code samples. If you have any more questions, feel free to leave me a comment.

Error: System.Security.SecurityException: Request for the permission of type 'Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' failed

CoreyRoth — Wed, 08 Oct 2008 14:22:41 GMT

Since I am talking about Implementing Partial Trust using Code Access Security this week, I thought I would talk about the following error when using a web part that doesn't have code access security set on it.

System.Security.SecurityException: Request for the permission of type 'Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=12.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' failed.

This is the first error that someone taking their first dive into using partial trust with SharePoint might receive. The reason I post this today is that a lot of times when someone runs into an issue with partial trust, someone will just say deploy your DLL to the GAC or change your trust level to full. You don't need to this if you build your solution package (.wsp) to properly set permission levels. If you run into this issue, check out my updated post on Configuring Code Access Security on a Web Part. I wrote that post some time ago, but I have updated it as I have become more familiar with the process.

Using SharePoint with Enterprise Library 4.0 under Partial trust

CoreyRoth — Wed, 01 Oct 2008 15:52:55 GMT

Last year, I posted on how to use Enterprise Library 3.1 with SharePoint under partial trust. It was incredibly difficult to get it to work with SharePoint when using partial trust because none of the DLLs had the AllowPartiallyTrustedCallers attribute on them. This meant in order to get it to work, you had to add it to every AssemblyInfo.cs in the solution, sign it with your own strong name key, and then build and deploy it. It was a lot of effort.

Enterprise Library 4.0 has been out for a few months now, but I have yet to comment on it. I am pleased to report that with this new release, none of this overhead is required. All of the DLLs, have the AllowPartiallyTrustedCallers attribute which means all you have to do is reference the DLLs and assign appropriate permissions. I recommend putting Enterprise Library DLLs in a solution package which will make setting permissions easier. Last year's post should have most of the settings that you will need.

If you got turned off trying to implement Enterprise Library in the past with SharePoint, you might give it another try. With the APTCA change, it should make it much easier to use entlib for logging, exception handling, data access, or whatever.

More on Manfiest.xml

CoreyRoth — Thu, 04 Sep 2008 15:19:32 GMT

There are a ton of tools out there to create SharePoint solution packages (.wsp files) for you, but it is still a good idea to know what those tools are creating for you exactly. Sometimes, things don't always work right, and you may need to customize or tweak your manifest file. If you are new to SharePoint development, the Manifest.xml file is used during the deployment of a .wsp solution package. It tells SharePoint what files to copy, what features to install, where to put your binaries, adds SafeControl entries, as well as set code access security. The file seems pretty straight forward but there are a lot of ways to mess it up. As I pointed out in the past, do not put any comments in this file. It will cause all kinds of FAIL.

I'll start by go over the key elements of this file and point out some things you need to know about each one. If you create any of these main elements, note, that they will always require some kind of child element, otherwise the file won't validate. The first element we will talk about is FeatureManifests. This name as it sounds is used to deploy features. Your solution will install features but not activate them for you. You can list multiple features to install here using the FeatureManifest element. It's Location attribute specifies the path to the feature (inside the DDF file). What that means is the path specified to your feature.xml file will match whatever you have listed as the destination in your DDF file. We can talk about DDF files again another day if necessary.

<FeatureManifests>
    <FeatureManifest Location="MyFeature\feature.xml" />
</FeatureManifests>

The TemplateFiles element is used to copy out any additional files to the SharePoint server. These could be .webpart files, user controls, other XML files, application pages, master pages, etc. SharePoint will not copy any file that is not listed here (except for binaries and feature.xml and related files). Again, you can specify multiple TemplateFile child elements to copy multiple files. Part of what makes this file tricky is the paths. Some are relative, some require you to specify something inside the 12 hive. It takes some getting used to. In this case, if you are copying additional files into a feature folder for a web part, you would specify something like FEATURES\MyFeature\mywebpart.webpart.

<TemplateFiles>
  <TemplateFile Location="FEATURES\MyFeature\MyWebpart.webpart" />
</TemplateFiles>

The Assemblies element specifies which binaries will be deployed to SharePoint and where. You can copy multiple assemblies out at a time with a feature by specifying more than one Assembly element. The Assembly element has a Location attribute which typically just contains the DLL name (again dependent on where the DLL is copied in your DDF file). It also contains a DepoymentTarget attribute which specifies wether to copy it to the GAC (GlobalAssemblyCache) or the bin folder (WebApplication). It also contains a SafeControls element with the same syntax of what is used in the web.config.

<Assemblies>
  <Assembly DeploymentTarget="WebApplication" Location="MySolution.dll">
    <SafeControls>
      <SafeControl Assembly="MySolution, Version=1.0.0.0, Culture=neutral" Namespace="MySolution.WebParts" TypeName="*" Safe="True" />
    </SafeControls>
  </Assembly>
</Assemblies>

One thing to note here is that if you do not specify at least one assembly with a SafeControl element, SharePoint will decide that your solution does not contain a Web Application Resource and therefore will not deploy it when you specify a URL with stsadm. So, I typically include this line even if I don't have any controls or web parts in my solution. You will get an error like the one below.

This solution contains no resources scoped for a Web application and cannot be deployed to a particular Web application.

The last element, I am will talk about is CodeAccessSecurity. This of course is the most complex one. I have posted on this topic in the past and don't forget, I will be speaking about it next month. The post I have on it covers it in more detail that I will cover today. The one thing, I will remind you of is that it is ok to specify multiple assemblies.

I haven't talked about the root element yet. It's pretty simple. Just remember the SolutionId needs to be unique. The ResetWebServer attribute can be set to false if you don't want it to reset IIS on deployment.

<Solution SolutionId="{B3270C0DF-EACA-4320-9B2A-C293435C5DF1}"  xmlns="http://schemas.microsoft.com/sharepoint/" ResetWebServer="true">

Anyhow, hopefully this will help someone out the next time they are looking at a manfiest.xml file.

Speaking at Tulsa Tech Fest again

CoreyRoth — Tue, 02 Sep 2008 16:10:51 GMT

Tulsa Tech Fest was a lot of fun last year and I am excited to be speaking at it again this year. This year, I will be giving a talk on Implementing Partial Trust in SharePoint. It should be a good talk in explaining how to create SharePoint solutions that can deploy Code Access Security settings.

It also looks like the DotNetMafia might be involved in putting together an unofficial "social event". More details on that to come.

ReflectionPermission Required for LINQ to SQL under Partial Trust

CoreyRoth — Mon, 28 Jan 2008 19:45:00 GMT

So by now, I can assume everyone has been listening to me and you are using partial trust in all of your SharePoint environments right? Ok, probably not, but for the two of you in the world that are, this post is for you. If you decide to use LINQ to SQL in any of your development, I have discovered that ReflectionPermission is needed by LINQ to SQL. I don't know the exact permissions it needs yet, but if you are in a bind to get it to work in your partial trust you can use a line like the following. I try to avoid giving any permission unrestricted access, but until you find out what the underlying class actually needs, it is dificult. To get you by, use a line like this.

Also some more obvious permissions LINQ to SQL will need is SqlClientPermission and probably ConfigurationPermission.

The DataSourceID of 'TopNavigationMenu' must be the ID of a control of type IHierarchicalDataSource. A control with ID 'topSiteMap' could not be found.

C-Dog's .NET Tip of the Day — Wed, 05 Dec 2007 20:32:33 GMT

Today's topic is how to resolve the following error. The DataSourceID of 'TopNavigationMenu' must be the ID of a control of type IHierarchicalDataSource. A control with ID 'topSiteMap' could not be found. Go ahead, search Google for...(read more)

How to get Enterprise Library working with SharePoint

C-Dog's .NET Tip of the Day — Wed, 05 Sep 2007 22:41:41 GMT

Once again, the most seemingly simple task with SharePoint has proved to be incredibly difficult. Continuing with my commitment to post the most information possible about SharePoint oddities, here is today's post. My goal today, I thought was simple...(read more)

More on Code Access Security

C-Dog's .NET Tip of the Day — Tue, 28 Aug 2007 20:47:00 GMT

I had promised an update to my Code Access Security post, so here it is. Hopefully, by now you have stopped being a cowboy and got your DLL out of the GAC and put the trust level back to minimal. If not, it is time. Here is some more info. Not just web...(read more)

How to configure Code Access Security for a Web Part

C-Dog's .NET Tip of the Day — Thu, 05 Jul 2007 23:00:00 GMT

As a new SharePoint developer, you will be directed to install your first Hello World web part in the GAC. Right now red flags should be going off for any non-noob developer. This allows your code to operate with Full Trust (which is bad). To properly...(read more)

Avoid Comments in a SharePoint Deployment Manifest

C-Dog's .NET Tip of the Day — Thu, 05 Jul 2007 17:42:35 GMT

In order to properly install a web part with Code Access Security, it is necessary to create a deployment solution. My next post will cover these and the proper way to specify code access security for a web part. In the meantime though, I wanted to post...(read more)