Hi There,

I have been using a host for ages and they recently turned on Medium trust on thier hosting accounts which of course has made my application break.

Nhibernate states:
That assembly does not allow partially trusted callers.

I have read the other posts on the forum and recompiled Nhibernate and added the [assembly: AllowPartiallyTrustedCallers] attribute to the Nhibernate project but not to any of the other pojects in the Nhibernate-eveything solution. recompiled it and it still reports the same error do i need to add that attribute to every project on the Nhibernate solution? Also will Nhibernate run under medium trust?

Thanks for you Help!
-Alex


Hibernate version:

NHibernate 1.2.0 Alpha1 debug

Mapping documents:

N/A

Code between sessionFactory.openSession() and session.close():

N/A

Full stack trace of any exception that occurs:

N/A

Name and version of the database you are using:

N/A

The generated SQL (show_sql=true):

N/A

Debug level Hibernate log excerpt:

N/A

I have done some further research and work into the medium trust issues for all the users who want to use nhibernate in a hosted environment:

I still haven't got it working but here are the steps I worked through to get to this point:

1. Added <trust level="Medium" originUrl="" /> to my webconfig so I could test what was going wrong on my hosting enviroment.

1. I downloaded the SVN version of Nhibernate from the source forge repository the added the Nhibernate 2.0 project and the Iesi.Collections project to my application solution. I told the Hibernate project to reference the Iesi.Collection project rather than the precompiled version.

2. Added the [assembly: AllowPartiallyTrustedCallers] attriubte to the AssemblyInfo.cs (and added a refrence to using System.Security;) on both the Nhibernate project and the Iesi collection project.

This removed the not allowing partial trust issues.

3. Added the
<add key="hibernate.use_reflection_optimizer" value="false" />
To my HBM config i think this removes some of the need for reflection (which isn't allowed on Medium trust hosts)

The Error I’m stuck at now is:

Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

From what I can tell this is a generic error making it hard to work out what the issue is.

Stack Trace:

at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Assembly asm, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed)\r\n at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Object assemblyOrString, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed)\r\n at System.Security.CodeAccessSecurityEngine.CheckSetHelper(PermissionSet grants, PermissionSet refused, PermissionSet demands, RuntimeMethodHandle rmh, Object assemblyOrString, SecurityAction action, Boolean throwException)\r\n at System.Security.CodeAccessSecurityEngine.CheckSetHelper(CompressedStack cs, PermissionSet grants, PermissionSet refused, PermissionSet demands, RuntimeMethodHandle rmh, Assembly asm, SecurityAction action)\r\n at Linked.Data.NHibernateSessionManager.get_threadTransaction()\r\n at Linked.Data.NHibernateSessionManager.CommitTransaction()\r\n at Linked.Web.NHibernateSessionModule.EndTransaction(Object sender, EventArgs e)\r\n at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()\r\n at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)"

Any idea where I have gone wrong? Would be great to get this working in a medium trust environment i can think of several projects I could use it on :)

Thanks
A

Don't know if will help you but I found this while I was reading the documentation of VS2005.

ms-help://MS.VSCC.v80/MS.MSDN.v80/MS.VisualStudio.v80.en/dv_fxconfig/html/0f130bcd-1bba-4346-b231-0bcca7dab1a4.htm

Hi Cassiot,

Thanks for you reply! I looked through that it does give a great run down of the security policy but I think this would be perfect if I had control to configure it myself but my host wont let me over ride nor define my own :( The only other way to give Nhibernate full trust would be to sign it and whack it in the GAC but I dont belive the host will even let me do that :( So its a matter of working out how to reduce the needed permissions on the Nhibernate core so it will play nicly with medium trust enviroments. From now on all my porjects will be designed to run in medium trust straight out other wise it can really stuff things up later on.

Thanks heaps!
A

Hi Maxus,

Unfortunately, I don't have a solution for you but I just wanted to add some more weight behind your request to have NH play nicely in a hosted environment with a reduced level of trust (which seems to be the majority nowadays).

I had to drop NH from my last project because of this reason and there didn't seem to be much response from the NH team when I posted to the forum. It would be great if they would devote some time to fixing this because it does limit the use of an otherwise fantastic product.

Cheers,

Jason

Hi Jason,

Thanks for your support! Agreed its a very powerful product and it would be great to see it accessible to more people. I also understand how hard it is coding powerful application with restrictions such as the medium security level has. I have spent a huge amount of time coding my site in nhibernate and it runs sooo well its really sad (and frustrating) to think I might have to scrap my work and start over.

This issue has been around for a fair while by the looks of things:
http://jira.nhibernate.org/browse/NH-442 ( ~ 6 months)

I would be happy to spend some time working on it to make it compatible with medium but i'm not sure even where to start.

The only ORM I have seen that supports medium trust activly is the wilson OR mapper (put you have to do some things in a certain way). feel free to tell me if anyone knows of any others.

Does anyone know if the next version of Nhibernate is going to support medium trust or if its even coming?

Thanks
A

Hmmm...that JIRA is marked as "Resolved" with a resolution of "Won't Fix"...does this mean that NH is never going to be changed to run in anything other than full trust? Limits the scope of use considerably.

I've just updated (reopened) the issue. I personally don't know what causes problems under medium trust. Is anybody willing to investigate and provide patches or at least detailed descriptions of changes need to be made to NH?

One thing that seems to be crucial is the AllowPartiallyTrustedCallers attribute:

http://forum.hibernate.org/viewtopic.php?t=952705

Yes but in the thread you linked to nobody could justify the need for APTCA and we need to be careful when adding security attributes. Can somebody describe a scenario where APTCA actually helped them?

Also, I'm not entirely sure that NHibernate is in fact safe to be called by partially-trusted code when NHibernate assembly itself has full trust.

Not sure if this is helpful, but I was able to use the ILMerge utility from Microsoft, and create a new assembly out of the NHibernate and associated libs (lost strong naming, though), and use it on my medium trust hosting acct. Didn't fully investigate if there are any other problems, but do let me know...

I've recently ran into the same partial trust problem on shared asp.net 2.0 web hosting, but I have managed to start NHibernate (version 1.2.0 Alpha1), basically following Maxus' steps:

1. Used ILMerge.exe on Castle.DynamicProxy.dll to remove strong naming.
2. Recompiled Iesi.Collections and NHibernate 1.2.0 Alpha1 (changed the reference to Castle.DynamicProxy to the new one and added [assembly: AllowPartiallyTrustedCallers] attribute to both projects).
3. Added the
<add key="hibernate.use_reflection_optimizer" value="false" /> to the configuration file.
4. Added requirePermission="false" attribute to the NHibernate section tag in web.config:
<section name="nhibernate" requirePermission="false" ... >

For Sergey: the reason to add APTCA is very clear to me. Without it, NHibernate is not usable on medium trust (specifically Asp.NET 2.0 shared hosting - a rather common type of hosting), although adding the attribute might not seem fair for people who run their applications on full trust. Having two binary versions available would be nice.

For Maxus: it seems to me that your problem lies within your session manager. NHibernateSessionManager probably uses CallContext to store current nhibernate transaction and session. CallContext does not work on medium trust. You can try to use HttpContext.Current instead.

I also managed to use Ayende's NHibernate.Generics with medium trust access (although version 1.2.0 of NHibernate has native support for generics), but I had to almost completely reimplement GenericGetter, GenericSetter and GenericAccessor classes, because they relied on Reflection to read values of private fields (which is only allowed on full trust).

There might be other problems caused by reflection, but apparently everything works fine now.

I have added APTCA to the SVN version of NHibernate. I originally thought it had no effect on non-full-trust assemblies, but after carefully re-reading the documentation I understood it is required even in this case.

So, I've run into the same issue. We're trying to launch to a site hosted by Network Solutions. I've gotten most of the way through adding the APTCA to the assemblies. I'm also working with Ayende's NHibernate.Generics, so my question for zbanga or womever is, what's going to be the least effort: Reimplementing the methods in the NHibernate.Generics objects, using generics as provided by the new version of NHibernate, or tearing out NHibernate altogether?

So I'm following zbanga's lead. I've removed the strong name from Castle.DynamicProxy, but when I try to recompile NHibernate with a reference to the new assembly it gives me the obvious, yet annoying error: Assembly Generation Failed -- Referenced Assembly 'Castle.DynamicProxyNew' does not have a strong name.

What am I missing?

Thanks!