Save config data in Medium Trust

Thread view:

Enable EMail Alerts

Start New Thread

Thread rating:

Roger Martin - 15 Aug 2007 03:22 GMT

I have configuration data for a web application stored in a file
galleryserverpro.config located in a config folder off the root application.
Web.config references this file like this:
<galleryServerPro configSource="config\galleryserverpro.config"/>

I built a custom configuration settings class (inherited from
ConfigurationSection) to access this data and it works great in Full Trust.
However, in Medium Trust I get a SecurityException on the following line:

System.Configuration.Configuration config =
System.Web.Configuration.WebConfigurationManager.OpenWebConfiguration("~/config/galleryserverpro.config");

It is failing because OpenWebConfiguration is trying to access
machine.config, which is not accessible under Medium Trust.

This is a web application meant for wide deployment and I have no control
over the hosting providers, so it must work in Medium Trust without any
policy alterations.

What are my options? The only idea I found was to abandon using the
configuration classes of .NET 2.0 and instead use XML classes and treat it as
an XML file. I don't want to do this because I will lose all the wonderful
features - like data type checking - of the .NET 2.0 configuration model!

I don't want to update machine.config - I only want to update this
particular file. I have 100+ configuration settings in it and I am faced with
many hours of work to port this to an XML read/write model. Hopefully I am
missing something simple.

Regards,
Roger Martin
Gallery Server Pro / www.galleryserverpro.com

Reply to this Message

Walter Wang [MSFT] - 15 Aug 2007 09:19 GMT

Hi Roger,

In this case, since you're only trying to read your custom section, we can
use WebConfigurationManager.GetSection() to get the individual section
instead of the OpenWebConfiguration().

Here's a sample:

in web.config:

    <configSections>
        <section name="mySection"
type="System.Configuration.NameValueSectionHandler"
requirePermission="false" />
    </configSections>
    <mySection configSource="mySection.config" />

in mySection.config:

<mySection>
    <add key="key1" value="value1" />
</mySection>

In code:

NameValueCollection cols = (NameValueCollection)
WebConfigurationManager.GetSection("mySection");

Hope this helps.

Regards,
Walter Wang (wawang@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Reply to this Message

Roger Martin - 17 Aug 2007 01:45 GMT

I am sorry, Walter, but the web app *is* writing to this config file. I built
a series of admin web pages that let users change config settings. Sorry if I
wasn't clear on this.

To rephrase the question: How can a web app in Medium Trust save changes to
one of its own config files that are being managed using the .NET 2.0
Configuration API? The config file is within the web app directory.

-Roger

Reply to this Message

Walter Wang [MSFT] - 17 Aug 2007 09:34 GMT

Hi Roger,

I somehow overlooked the requirement is to "save" instead of "read-only",
sorry.

I just re-checked the document and confirmed that
WebConfigurationManager.OpenWebConfiguration requires Full Trust.

I'll do some further researching and consulting to see if there's other
solution to this issue other than creating a separate assembly and install
into GAC to give it Full Trust.

Regards,
Walter Wang (wawang@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Reply to this Message

Walter Wang [MSFT] - 22 Aug 2007 04:45 GMT

Hi Roger,

Sorry for late reply. I've been consulting your question within our
internal discussion list.

Unfortunately there's no other good way to edit web site's web.config under
medium trust. Currently the OpenWebConfiguration will always require full
trust to run; and we have to use it to get a reference to the configuration
items. Sorry for the inconvenience caused.

If you don't want to create a separate assembly and give it full trust or
create a custom policy, then you might have to fallback to plain xml
document processing to edit the web configuration.

#How To: Use Medium Trust in ASP.NET 2.0
http://msdn2.microsoft.com/en-us/library/ms998341.aspx

Regards,
Walter Wang (wawang@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Reply to this Message

Roger Martin - 23 Aug 2007 22:58 GMT

Any word on this, Walter? This is the last major issue preventing my app from
working in medium trust.

Roger

Reply to this Message

Walter Wang [MSFT] - 27 Aug 2007 07:19 GMT

Hi Roger,

Since the web site's web.config is actually inheriting some settings from
machine.config (or its parent folder's web.config, if there's any), the
WebConfigurationManager API will have to be able to access them to provide
full object model of the settings. Therefore I'm afraid there's no other
way to workaround this.

Regards,
Walter Wang (wawang@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Reply to this Message

Roger Martin - 27 Aug 2007 14:08 GMT

Thanks for getting to the bottom of this, Walter. The inability to save
settings using the Configuration API in medium trust certainly takes all the
fun out of the API. I'll cross my fingers that .NET 3.5 addresses this issue.

Cheers,
Roger Martin

Reply to this Message

Walter Wang [MSFT] - 28 Aug 2007 06:47 GMT

Hi Roger,

Thanks for your quick reply.

I agree this is a limitation of the Configuration API. Your feedback is
recorded and will be correctly forwarded to product team.

Please let me know if there's anything else I can help.

Regards,
Walter Wang (wawang@online.microsoft.com, remove 'online.')
Microsoft Online Community Support

==================================================
When responding to posts, please "Reply to Group" via your newsreader so
that others may learn and benefit from your issue.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

Reply to this Message

Save config data in Medium Trust

Free Magazines