Re: linkdemand for principalpermission

From: Nicole Calinoiu (calinoiu)
Date: 10/07/05 

Date: Fri, 7 Oct 2005 09:39:00 -0400

"Jas" <Jas@discussions.microsoft.com> wrote in message
news:14C94F27-6A8A-4A9B-A826-048517566E73@microsoft.com...
>I can't seem to understand what a linkdemand for a principalpermission
>means?

Pretty much nothing.

> If linkdemands are satisfied at JIT phase, how can it figure out the
> current
> principal before running the code?

It can't.

> For example, if I was going to use windowsprincipals to make RBS
> decisions,
> and I decorate a method with a linkdemand for principalpermission of
> "BUILTIN\ADMINISTARTORS" like this:
>
> [PrincipalPermissionAttribute(SecurityAction.LinkDemand, Role =
> @"BUILTIN\Administrators")]
> static void MethodA()
>
>
> how would the JIT figure this out without running the code? When I runthe
> above code, it always produces "SecurityException: Request for principal
> permission failed....". And it looks that is happening at JIT phase not
> runtime. This becomes even more of an issue when I'm using generic roles.
>
> Am I missing something?

You should be using SecurityAction.Demand, not SecuirtyAction.LinkDemand, in
your PrincipalPermission attributes (and, for other reasons, most other
permission request attributes with the occasional exception of identity
permissions). PrincipalPermission does not inherit from
CodeAccessPermission, and it does not perform a stack walk, so there's
essentially no point in even trying the link demand approach anyway (even if
it did work <g>).

Relevant Pages

  • Re: PrincipalPermission trouble
    ... I agree that PrincipalPermission is not really a CAS Permission because it ... > so in other words - there is no performance optimization using LinkDemand ... This security check does not check ... >> But Demand I don't use for performance reasions. ...
    (microsoft.public.dotnet.security)
  • Re: PrincipalPermission trouble
    ... a stack walk) - PrincipalPermission does only call IsInRoleon Thread.CurrentPrincipal ... LinkDemand just doesn't make sense here - user security is not stack or link ...
    (microsoft.public.dotnet.security)
  • Re: Design Question
    ... >> the declaration of the PrincipalPermission attribute and the call to ... Implement the check as a custom permission with a corresponding ... If I want to check permission on each public method of a web service, ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Design Question
    ... mechanism for directly retrieving a reference to the attribute target. ... permission or a principal permission with custom principal) or use a tool ... > But all role-based security information resides in AzMan store. ... >> the declaration of the PrincipalPermission attribute and the call to ...
    (microsoft.public.dotnet.languages.csharp)
  • Re: Declarative security
    ... (assuming the UserProfile class has a read-only UserName property): ... PrincipalPermission perm = new PrincipalPermission(this.UserName, ... > Consider my own Permission attribute and my own Permisssion class. ... > private void Update ...
    (microsoft.public.dotnet.security)
Quantcast