These old forums are deprecated now and set to read-only. We are waiting for you on our new forums!
More modern, Discourse-based and with GitHub/Google/Twitter authentication built-in.

All times are UTC - 5 hours [ DST ]



Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 33 posts ]  Go to page 1, 2, 3  Next
Author Message
 Post subject: Medium Trust Nhibernate
PostPosted: Wed Jul 12, 2006 2:52 am 
Newbie

Joined: Sat Jun 10, 2006 10:24 am
Posts: 16
Hi There,

I have been using a host for ages and they recently turned on Medium trust on thier hosting accounts which of course has made my application break.

Nhibernate states:
That assembly does not allow partially trusted callers.

I have read the other posts on the forum and recompiled Nhibernate and added the [assembly: AllowPartiallyTrustedCallers] attribute to the Nhibernate project but not to any of the other pojects in the Nhibernate-eveything solution. recompiled it and it still reports the same error do i need to add that attribute to every project on the Nhibernate solution? Also will Nhibernate run under medium trust?

Thanks for you Help!
-Alex


Hibernate version:

NHibernate 1.2.0 Alpha1 debug

Mapping documents:

N/A

Code between sessionFactory.openSession() and session.close():

N/A

Full stack trace of any exception that occurs:

N/A

Name and version of the database you are using:

N/A

The generated SQL (show_sql=true):

N/A

Debug level Hibernate log excerpt:

N/A


Top
 Profile  
 
 Post subject: Futher Testing and Results
PostPosted: Thu Jul 13, 2006 5:16 am 
Newbie

Joined: Sat Jun 10, 2006 10:24 am
Posts: 16
I have done some further research and work into the medium trust issues for all the users who want to use nhibernate in a hosted environment:

I still haven't got it working but here are the steps I worked through to get to this point:

1. Added <trust level="Medium" originUrl="" /> to my webconfig so I could test what was going wrong on my hosting enviroment.

1. I downloaded the SVN version of Nhibernate from the source forge repository the added the Nhibernate 2.0 project and the Iesi.Collections project to my application solution. I told the Hibernate project to reference the Iesi.Collection project rather than the precompiled version.

2. Added the [assembly: AllowPartiallyTrustedCallers] attriubte to the AssemblyInfo.cs (and added a refrence to using System.Security;) on both the Nhibernate project and the Iesi collection project.

This removed the not allowing partial trust issues.

3. Added the
<add key="hibernate.use_reflection_optimizer" value="false" />
To my HBM config i think this removes some of the need for reflection (which isn't allowed on Medium trust hosts)

The Error I’m stuck at now is:

Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

From what I can tell this is a generic error making it hard to work out what the issue is.

Stack Trace:

at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Assembly asm, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed)\r\n at System.Security.CodeAccessSecurityEngine.ThrowSecurityException(Object assemblyOrString, PermissionSet granted, PermissionSet refused, RuntimeMethodHandle rmh, SecurityAction action, Object demand, IPermission permThatFailed)\r\n at System.Security.CodeAccessSecurityEngine.CheckSetHelper(PermissionSet grants, PermissionSet refused, PermissionSet demands, RuntimeMethodHandle rmh, Object assemblyOrString, SecurityAction action, Boolean throwException)\r\n at System.Security.CodeAccessSecurityEngine.CheckSetHelper(CompressedStack cs, PermissionSet grants, PermissionSet refused, PermissionSet demands, RuntimeMethodHandle rmh, Assembly asm, SecurityAction action)\r\n at Linked.Data.NHibernateSessionManager.get_threadTransaction()\r\n at Linked.Data.NHibernateSessionManager.CommitTransaction()\r\n at Linked.Web.NHibernateSessionModule.EndTransaction(Object sender, EventArgs e)\r\n at System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute()\r\n at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously)"

Any idea where I have gone wrong? Would be great to get this working in a medium trust environment i can think of several projects I could use it on :)

Thanks
A


Top
 Profile  
 
 Post subject:
PostPosted: Thu Jul 13, 2006 9:00 am 
Beginner
Beginner

Joined: Mon Mar 06, 2006 2:19 pm
Posts: 42
Location: Belo Horizonte, Brazil
Don't know if will help you but I found this while I was reading the documentation of VS2005.

ms-help://MS.VSCC.v80/MS.MSDN.v80/MS.VisualStudio.v80.en/dv_fxconfig/html/0f130bcd-1bba-4346-b231-0bcca7dab1a4.htm


Top
 Profile  
 
 Post subject: Medium Trust
PostPosted: Thu Jul 13, 2006 9:32 pm 
Newbie

Joined: Sat Jun 10, 2006 10:24 am
Posts: 16
Hi Cassiot,

Thanks for you reply! I looked through that it does give a great run down of the security policy but I think this would be perfect if I had control to configure it myself but my host wont let me over ride nor define my own :( The only other way to give Nhibernate full trust would be to sign it and whack it in the GAC but I dont belive the host will even let me do that :( So its a matter of working out how to reduce the needed permissions on the Nhibernate core so it will play nicly with medium trust enviroments. From now on all my porjects will be designed to run in medium trust straight out other wise it can really stuff things up later on.

Thanks heaps!
A


Top
 Profile  
 
 Post subject:
PostPosted: Thu Jul 13, 2006 9:47 pm 
Senior
Senior

Joined: Sat Sep 03, 2005 12:54 am
Posts: 139
Hi Maxus,

Unfortunately, I don't have a solution for you but I just wanted to add some more weight behind your request to have NH play nicely in a hosted environment with a reduced level of trust (which seems to be the majority nowadays).

I had to drop NH from my last project because of this reason and there didn't seem to be much response from the NH team when I posted to the forum. It would be great if they would devote some time to fixing this because it does limit the use of an otherwise fantastic product.

Cheers,

Jason


Top
 Profile  
 
 Post subject: Thanks
PostPosted: Fri Jul 14, 2006 5:44 am 
Newbie

Joined: Sat Jun 10, 2006 10:24 am
Posts: 16
Hi Jason,

Thanks for your support! Agreed its a very powerful product and it would be great to see it accessible to more people. I also understand how hard it is coding powerful application with restrictions such as the medium security level has. I have spent a huge amount of time coding my site in nhibernate and it runs sooo well its really sad (and frustrating) to think I might have to scrap my work and start over.

This issue has been around for a fair while by the looks of things:
http://jira.nhibernate.org/browse/NH-442 ( ~ 6 months)

I would be happy to spend some time working on it to make it compatible with medium but i'm not sure even where to start.

The only ORM I have seen that supports medium trust activly is the wilson OR mapper (put you have to do some things in a certain way). feel free to tell me if anyone knows of any others.

Does anyone know if the next version of Nhibernate is going to support medium trust or if its even coming?

Thanks
A


Top
 Profile  
 
 Post subject:
PostPosted: Wed Jul 26, 2006 6:52 am 
Senior
Senior

Joined: Sat Sep 03, 2005 12:54 am
Posts: 139
Hmmm...that JIRA is marked as "Resolved" with a resolution of "Won't Fix"...does this mean that NH is never going to be changed to run in anything other than full trust? Limits the scope of use considerably.


Top
 Profile  
 
 Post subject:
PostPosted: Wed Jul 26, 2006 7:57 am 
Contributor
Contributor

Joined: Wed May 11, 2005 4:59 pm
Posts: 1766
Location: Prague, Czech Republic
I've just updated (reopened) the issue. I personally don't know what causes problems under medium trust. Is anybody willing to investigate and provide patches or at least detailed descriptions of changes need to be made to NH?


Top
 Profile  
 
 Post subject:
PostPosted: Wed Jul 26, 2006 8:56 pm 
Senior
Senior

Joined: Sat Sep 03, 2005 12:54 am
Posts: 139
One thing that seems to be crucial is the AllowPartiallyTrustedCallers attribute:

http://forum.hibernate.org/viewtopic.php?t=952705


Top
 Profile  
 
 Post subject:
PostPosted: Thu Jul 27, 2006 5:33 am 
Contributor
Contributor

Joined: Wed May 11, 2005 4:59 pm
Posts: 1766
Location: Prague, Czech Republic
Yes but in the thread you linked to nobody could justify the need for APTCA and we need to be careful when adding security attributes. Can somebody describe a scenario where APTCA actually helped them?

Also, I'm not entirely sure that NHibernate is in fact safe to be called by partially-trusted code when NHibernate assembly itself has full trust.


Top
 Profile  
 
 Post subject: Medium Trust NHibernate
PostPosted: Fri Jul 28, 2006 12:38 am 
Newbie

Joined: Fri Jul 28, 2006 12:28 am
Posts: 1
Not sure if this is helpful, but I was able to use the ILMerge utility from Microsoft, and create a new assembly out of the NHibernate and associated libs (lost strong naming, though), and use it on my medium trust hosting acct. Didn't fully investigate if there are any other problems, but do let me know...


Top
 Profile  
 
 Post subject: NHibernate 1.2.0 Alpha1 on partial trust
PostPosted: Mon Jul 31, 2006 11:25 am 
Newbie

Joined: Mon Jul 31, 2006 10:16 am
Posts: 3
I've recently ran into the same partial trust problem on shared asp.net 2.0 web hosting, but I have managed to start NHibernate (version 1.2.0 Alpha1), basically following Maxus' steps:

1. Used ILMerge.exe on Castle.DynamicProxy.dll to remove strong naming.
2. Recompiled Iesi.Collections and NHibernate 1.2.0 Alpha1 (changed the reference to Castle.DynamicProxy to the new one and added [assembly: AllowPartiallyTrustedCallers] attribute to both projects).
3. Added the
<add key="hibernate.use_reflection_optimizer" value="false" /> to the configuration file.
4. Added requirePermission="false" attribute to the NHibernate section tag in web.config:
<section name="nhibernate" requirePermission="false" ... >

For Sergey: the reason to add APTCA is very clear to me. Without it, NHibernate is not usable on medium trust (specifically Asp.NET 2.0 shared hosting - a rather common type of hosting), although adding the attribute might not seem fair for people who run their applications on full trust. Having two binary versions available would be nice.

For Maxus: it seems to me that your problem lies within your session manager. NHibernateSessionManager probably uses CallContext to store current nhibernate transaction and session. CallContext does not work on medium trust. You can try to use HttpContext.Current instead.

I also managed to use Ayende's NHibernate.Generics with medium trust access (although version 1.2.0 of NHibernate has native support for generics), but I had to almost completely reimplement GenericGetter, GenericSetter and GenericAccessor classes, because they relied on Reflection to read values of private fields (which is only allowed on full trust).

There might be other problems caused by reflection, but apparently everything works fine now.


Top
 Profile  
 
 Post subject:
PostPosted: Mon Jul 31, 2006 11:47 am 
Contributor
Contributor

Joined: Wed May 11, 2005 4:59 pm
Posts: 1766
Location: Prague, Czech Republic
I have added APTCA to the SVN version of NHibernate. I originally thought it had no effect on non-full-trust assemblies, but after carefully re-reading the documentation I understood it is required even in this case.


Top
 Profile  
 
 Post subject: Need Advice
PostPosted: Wed Aug 02, 2006 3:25 pm 
Newbie

Joined: Wed Aug 02, 2006 3:12 pm
Posts: 5
Location: Denver, CO
So, I've run into the same issue. We're trying to launch to a site hosted by Network Solutions. I've gotten most of the way through adding the APTCA to the assemblies. I'm also working with Ayende's NHibernate.Generics, so my question for zbanga or womever is, what's going to be the least effort: Reimplementing the methods in the NHibernate.Generics objects, using generics as provided by the new version of NHibernate, or tearing out NHibernate altogether?


Top
 Profile  
 
 Post subject:
PostPosted: Fri Aug 04, 2006 5:40 pm 
Newbie

Joined: Wed Aug 02, 2006 3:12 pm
Posts: 5
Location: Denver, CO
So I'm following zbanga's lead. I've removed the strong name from Castle.DynamicProxy, but when I try to recompile NHibernate with a reference to the new assembly it gives me the obvious, yet annoying error: Assembly Generation Failed -- Referenced Assembly 'Castle.DynamicProxyNew' does not have a strong name.

What am I missing?

Thanks!


Top
 Profile  
 
Display posts from previous:  Sort by  
Forum locked This topic is locked, you cannot edit posts or make further replies.  [ 33 posts ]  Go to page 1, 2, 3  Next

All times are UTC - 5 hours [ DST ]


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum

Search for:
© Copyright 2014, Red Hat Inc. All rights reserved. JBoss and Hibernate are registered trademarks and servicemarks of Red Hat, Inc.