How to configure custom CAS deployed through WSP package

Question

I have been struggling with deployment of custom CAS. When I deploy my WSP package I get the following error:

Security Exception Description: The application attempted to perform an operation not allowed by the security policy. To grant this application the required permission please contact your system administrator or change the application's trust level in the configuration file.

Exception Details: System.Security.SecurityException: Request for the permission of type 'Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' failed.

Source Error:

An unhandled exception was generated during the execution of the current web request. Information regarding the origin and location of the exception can be identified using the exception stack trace below.

Stack Trace:

[SecurityException: Request for the permission of type 'Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c' failed.]
System.Reflection.Assembly._GetType(String name, Boolean throwOnError, Boolean ignoreCase) +0
System.Web.UI.Util.GetTypeFromAssemblies(ICollection assemblies, String typeName, Boolean ignoreCase) +201
System.Web.UI.TemplateParser.GetType(String typeName, Boolean ignoreCase, Boolean throwOnError) +323
System.Web.UI.TemplateParser.ProcessInheritsAttribute(String baseTypeName, String codeFileBaseTypeName, String src, Assembly assembly) +10864044
System.Web.UI.TemplateParser.PostProcessMainDirectiveAttributes(IDictionary parseData) +365

I figured out that I need a cutom CAS for my dlls but I have not found any article which would clearly state what exactly do.

I suppose that I should edit Package.Template.xml and add the custom policices there, e.g.:

<?xml version="1.0" encoding="utf-8"?>
<Solution xmlns="http://schemas.microsoft.com/sharepoint/">
  <CodeAccessSecurity>
    <PolicyItem>
      <Assemblies>
        <Assembly Name="$SharePoint.Project.AssemblyName$"
                  Version="$SharePoint.Project.AssemblyVersion$"
                  PublicKeyBlob="$SharePoint.Project.AssemblyPublicKeyBlob$"/>
      </Assemblies>
      <PermissionSet class="NamedPermissionSet" version="1" Name="SPRestricted">
        <IPermission class="AspNetHostingPermission" version="1" Level="Minimal" />
        <IPermission class="SecurityPermission" version="1" Flags="Execution" />
        <IPermission class="WebPartPermission" version="1" Connections="True" />
        <IPermission class="SharePointPermission" version="1" ObjectModel="True" />
        <IPermission class="SqlClientPermission" version="1" Unrestricted="true" />
        <IPermission class="Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" version="1" ObjectModel="True" />
      </PermissionSet>
    </PolicyItem>
  </CodeAccessSecurity>
</Solution>

The code above was taken from this article: http://alexanderst.wordpress.com/2011/03/03/adding-cas-permissions-to-wsp-in-sharepoint-2010/

I tried to use the code above but the exception is still the same. What assemblies should I state in the assembly section? Is it possible to use any preprocessor variables like in the example so I do not need to worry when the assemblies change? Has anyone stumbled on an article which would actually explain what the xml elements of CodeAccessSecurity mean/do?

Answer 1

It seems I have figured that out myself - at least partly.

There are two task you have to do:

• pick the right permissions to give to your assemblies
• choose/state all assemblies that are involved (that should have the permissions) - this probably means that you need to state all the assemblies that violate the policy, hence those that need to be given the permissions

And my final xml:

<?xml version="1.0" encoding="utf-8"?>
<Solution xmlns="http://schemas.microsoft.com/sharepoint/">
  <CodeAccessSecurity>
    <PolicyItem>
      <Assemblies>
        <Assembly Name="$SharePoint.Project.AssemblyName$"
                  Version="$SharePoint.Project.AssemblyVersion$"
                  PublicKeyBlob="$SharePoint.Project.AssemblyPublicKeyBlob$"/>
        <Assembly Name="Ninject"
                  Version="3.0.0.0"
                  PublicKeyBlob="0024000004800000940000000602000000240000525341310004000001000100f3fc252fdcdfdba2e6d41c88aa5d644aa480c3776f4d7a3f02625347a53fef16b3940741285b67067480cc1eda51f1a9b255cc3af2dcf77325621bd9f644de9e1311a5d2f8bd3054573da970c33566033d91c0fe4420d5b01f996a32ae3a44fad49974edb8546f418eca586ea085a1a175a1b79d6ec84f75d4b814a40b2abcb9" />

        <!-- some other assemblies that I removed -->
      </Assemblies>
      <PermissionSet class="NamedPermissionSet" version="1" Name="TrackWebpartsPermissions">
        <IPermission class="AspNetHostingPermission" version="1" Level="Minimal" />
        <IPermission class="SecurityPermission" version="1" Flags="Execution" />
        <IPermission class="WebPartPermission" version="1" Connections="True" />
        <IPermission class="SharePointPermission" version="1" ObjectModel="True" />
        <IPermission class="SqlClientPermission" version="1" Unrestricted="true" />

        <IPermission class="ReflectionPermission" version="1" Flags="ReflectionEmit, RestrictedMemberAccess"/>
        <IPermission class="Microsoft.SharePoint.Security.SharePointPermission, Microsoft.SharePoint.Security, Version=14.0.0.0, Culture=neutral, PublicKeyToken=71e9bce111e9429c" version="1" ObjectModel="True" />
      </PermissionSet>
    </PolicyItem>
  </CodeAccessSecurity>
</Solution>

However, I still don't understand what exactly you can and can't write into the IPermission elements.