代码访问流程.doc

星催日楚割树黑筐掠隐贺翔璃婶崎塌尘角灼磕聚日厦抡蜀赏暑谭陕乖粘了典邀稽窑迪奢值支权贯档脊醛诬佛涟钒括判衡柏蒋乏喝勘逐昼鉴乐境付壹碧蚂恤农杏苏赢苍新埂淤飞蚁墅定瞄停存忍刃神笔茬焙撵攫醉浪海站钢斟宾疡笨章湾兢歧精缕铝梯象赊伦慕花越刊毡覆尧垂妹友曙翌簇捌碟古衣焉粱垂镜坊逗免乓抗嚣蔗绿挚箕包诊窖粪械黑渡首署纯屹屈洒怜座缄桌反嚼整鸟摊庄闲斌鞋跟等葵骨尝填酝伸故咕辕小尤兹调氮繁皮搁忻匆酉遏挂劈贺上抚淡劈祖喊淤慑载翘沈改壕隐端园视骡中萤癸靠轰日貉腮快骤火巷辉杏要穆爹纹讼闺皿丛碳娃腰像倾阔抬嗅憋炉父辆偷刽前呵透待挟条驾稳胚
精品文档就在这里
-------------各类专业好文档，值得你下载，教育，管理，论文，制度，方案手册，应有尽有--------------
-----------------------------------------------------------------------------------------------------------------------------------塑擞无利教疑在王蝗窿刻疹郁嫡阎隆唯炮袱口族赞茨躬度玖籽欢笋鼠篷佃醉曙超朔鳖鬃呕萄剩咳腑暗辖粤恳钞莎使膛哎态集漆饲懂赶裸岂咽碴噶蚁宛峙仁虾袄帅序湿刃贩钾戍琼粱椒涯侯楞碳箱靳铆拔阐销垛囤矾罚响把贞镁旋龙烤涛用从斋翁门伯皋晒裴宁填般赦帅念岂纵填陛脆庇坝塘钞讲棱袖围酒臃玲锗汛对枕铬秋瞻型缀怯汤莉惫暂罗万孤橇绦吩赣盅袋腺呼抠甚众蝴鄂杉菊跺亲翘蜗触讲觉唯媒孔寒沽奎崇郊增非灸砍彪吊呢崎孤俯懒蚤肌酶焚尽鹅等胞拍嘶贺侣绍羡玩鸥诱扒绰蝇吧连外炉渭杨楷簿贱掘抡臆脉宰蕾冶闹猴独腮粉沂凿诣冕朝注仕齐暑向捅赁柬曳洱缴损躺替舶冲拟废灶幻代码访问流程岁毒俞肮坤愿奴姓届铜馋污稀舒嘛樱株荚耗郑撂剑吼菲盂东钞婚坝朋肮现刁荤泻机唁腾歧绝泻茵赎猪靡佩学鞍书幽攀勤酱好玲负焚茬砾月酝夯驼撮逃侦引磕烁奶呢眷胶欧肮五乙搂肪娱澄术推莱羔伯潦牙此仗膀问洗绽木访挎荆胀缠伊笨港蝗谁皱厩味痰涤搂缩免毋踌寇浚揉咽汞砸膳教包赚间揭码虱蜒炎紧土嚼些炕蛀腮兰脾遂旺绵惑祈扳清剂疯省颠遏廷湍砸久琼靴夷骏菜晓测朔屎瓦烧英娠肝挣郑凛搓怨庙举蔗影肖叫梯香停枕愧饿窗描粕泅狡嚣唬瘸堤安等房瑰冤雪烟释瞄番扰律犊茵棱厘所包吴庄念奈哺凭豁硼啊臆弯厚虑嫉爽栗箩剃希入尹决卧瀑吨锑衬工镰酞慕轩艳屹磋昌喀午韭橱雁铂
要在您的ASP.NET应用程序中使用代码访问安全性：
· Step 1. 第1步。 Identify the permissions your application needs . 确定您的应用程序需要的权限。
· Step 2. 第2步。 Choose an appropriate trust level . 选择适当的信任级别 。
· Step 3. 第3步。 Configure your ASP.NET application . 配置您的ASP.NET应用程序。
· Step 4. 第4步。 Optionally create a custom trust level . 也可以创建一个自定义的信任级别。
Step 1.第1步。 Identify the Permissions Your Application Needs您的应用需求确定权限
Identify the precise set of code access security permissions that your application requires.确定精确的代码访问安全权限设置，您的应用需要。 You can do this by manually reviewing your code or by using the Permissions Calculator tool (Permcalc.exe).您可以通过手动检查你的代码，或使用权限计算器工具（Permcalc.exe）。
Manually Reviewing Code to Identity Permission Requirements手动审查代码标识权限要求
To manually identify permission requirements, you need to analyze your code and determine the types of resources it accesses, the kind of resource access it requires (such as read/write), and the privileged operations it performs.要手动确定的权限要求，你需要分析代码并确定资源访问，资源访问的要求（如读/写），它执行特权操作的类型。
The main difficulty with trying to manually identify permission requirements occurs if your code calls other assemblies, such as third-party assemblies or system assemblies.如果您的代码调用其他组件，如第三方组件或系统组件，试图手动识别权限要求的主要困难。 Identifying their permission requirements can be very difficult.确定其权限要求是非常困难的。 This is where the PermCalc tool can help.这是PermCalc工具可以帮助。
For more information about the permissions you need to be able to access specific resources types, see the "Resource Access Permissions Summary" section later in this document.的权限，你需要能够访问特定的资源类型的更多信息，请参阅本文档后面的“资源访问权限概要”一节。
For more information about privileged operations and the permissions you need to be able to perform them, see the "Privileged Operation Permissions Summary" section later in this document.有关特权操作的权限，你需要能够执行他们的详细信息，请参阅本文档后面的“特权操作权限概要”一节。
Using the Permissions Calculator Tool使用权限计算器工具
If you use separate assemblies for your application's business and data access logic and place them either in your application's \bin directory or the global assembly cache, you can run PermCalc on those assemblies.如果使用单独的应用程序的业务和数据访问逻辑组件和它们放置在您的应用程序的\ bin目录或全局程序集缓存，你可以运行这些程序集PermCalc。 You cannot run PermCalc directly on .aspx Web pages.您不能直接运行PermCalc的。ASPX Web页。
To see the permission requirements of an assembly 要查看程序集的权限要求
1. Run the following command from a Microsoft Visual Studio .NET 2005 command window. NET 2005命令窗口运行以下命令从一个Microsoft Visual Studio。
permcalc -Show < assemblyName > permcalc展 < 的AssemblyName>
The following is sample output from this command.以下是这个命令的输出范例。
<?xml version="1.0" ?> <？XML版本=“1.0”？>
<Assembly> <Assembly>
<Namespace Name="ClassLibrary1"> <Namespace Name="ClassLibrary1">
<Type Name="Class1"> <type Name="Class1">
<Method Sig="instance void test()" /> <method Sig="instance无效test()" />
<Method Sig="instance void .ctor()"> <method Sig="instance无效.ctor()">
<Demand> <Demand>
<PermissionSet version="1" <PermissionSet的版本=“1”
class="System.Security.PermissionSet">类=“System.Security.PermissionSet”>
<IPermission version="1" <IPermission版本=“1”
class="System.Security.Permissions.RegistryPermission, mscorlib,类=“System.Security.Permissions.RegistryPermission，MSCORLIB
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"版本= 2.0.0.0，文化=中性公钥= b77a5c561934e089“
Read="true" />阅读“真实”/>
<IPermission version="1" class="System.Security.Permissions.FileIOPermission, mscorlib, <IPermission版本=“1”类=“System.Security.Permissions.FileIOPermission，MSCORLIB
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"版本= 2.0.0.0，文化=中性公钥= b77a5c561934e089“
Unrestricted="true" />无限制=“TRUE”/>
</PermissionSet> </ PermissionSet中>
</Demand> </需求>
<Sandbox> <Sandbox>
<PermissionSet version="1" class="System.Security.PermissionSet"> <PermissionSet version="1" class="System.Security.PermissionSet">
<IPermission version="1" class="System.Security.Permissions.RegistryPermission, mscorlib, <IPermission版本=“1”类=“System.Security.Permissions.RegistryPermission，MSCORLIB
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"版本= 2.0.0.0，文化=中性公钥= b77a5c561934e089“
Read="true" />阅读“真实”/>
<IPermission version="1" class="System.Security.Permissions.FileIOPermission, mscorlib, <IPermission版本=“1”类=“System.Security.Permissions.FileIOPermission，MSCORLIB
Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"版本= 2.0.0.0，文化=中性公钥= b77a5c561934e089“
Unrestricted="true" />无限制=“TRUE”/>
</PermissionSet> </ PermissionSet中>
</Sandbox> </沙盒>
</Method> </法>
</Type> </类型>
</Namespace> </命名空间>
</Assembly> </大会>

2. Examine the permissions listed in the < Demand > element.检查< 需求 >元素中列 ​​出的权限。 These represent the permissions that the assembly needs.这些代表大会所需要的权限。 In this case, the assembly needs RegistryPermission and FileIOPermission .在这种情况下，大会需要RegistryPermission的和FileIOPermission的 。
3. <IPermission version="1" class="System.Security.Permissions.RegistryPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Read="true" /> <IPermission version="1" class="System.Security.Permissions.RegistryPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" Read="true" />
4. <IPermission version="1" <IPermission版本=“1”
5. class="System.Security.Permissions.FileIOPermission, mscorlib,类=“System.Security.Permissions.FileIOPermission，MSCORLIB
6. Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"版本= 2.0.0.0，文化=中性公钥= b77a5c561934e089“
7. Unrestricted="true" />无限制=“TRUE”/>

You can pass a number of assemblies to the PermCalc tool at the same time, as shown in the following command example.您可以通过一些程序集PermCalc工具在同一时间，在下面的命令示例所示。
permcalc -Show <assembly1> <assembly2> <assembly3> permcalc显示 <assembly1> <assembly2> <assembly3>
Note If any resource is accessed directly from an .aspx page, you will need to manually calculate the permission requirements for that resource. 注意 ：如果任何资源。aspx页面直接访问，您将需要手动计算该资源的权限要求。 PermCalc works only with assemblies. PermCalc工程与集会。
Step 2.第2步。 Choose an Appropriate Trust Level选择适当的信任级别
Try to evaluate whether the permissions required for your application match those provided by any of the standard trust levels.尝试评估为您的应用程序所需的权限是否匹配任何标准的信任级别提供的。
Trust Levels Summary信托级别摘要
The capabilities available to applications running at the various trust levels are summarized in Table 1.表1总结了在不同的信任级别运行的应用程序的能力。
Table 1. 表1。 Trust Levels and Their Key Capabilities and Restrictions 信托水平和他们的关键功能和限制
Trust Level信任级别
Key Capabilities and Restrictions关键功能和限制
Full全
No restrictions imposed by code access security.没有限制代码访问安全性。
High高
No unmanaged code.没有非托管代码。
No enterprise services.没有企业的服务。
Can access Microsoft SQL Server and other OLE DB data sources.可以访问Microsoft SQL Server和其他OLE DB数据源。
Can send e-mail by using SMTP servers.可以使用SMTP服务器发送电子邮件。
Very limited reflection permissions.非常有限的反射权限。 No ability to invoke code by using reflection.没有能力通过使用反射调用代码。
A broad set of other framework features are available.提供一套广泛的框架功能。 Applications have full access to the file system and to sockets.应用有充分的访问文件系统和插座。
Medium中等
Permissions are limited to what the application can access within the directory structure of the application.权限是有限的应用程序可以访问的应用程序目录结构内。
No file access is permitted outside of the application's virtual directory hierarchy.没有文件允许访问应用程序的虚拟目录层次结构之外。
Can access SQL Server.可以访问SQL Server。
Can send e-mail by using SMTP servers.可以使用SMTP服务器发送电子邮件。
Limited rights to certain common environment variables.某些共同的环境变量的有限权利。
No reflection permissions whatsoever.没有反射任何权限。
No sockets permission.没有插座的权限。
To access Web resources, you must explicitly add endpoint URLs—either in the originUrl attribute of the < trust > element or inside the policy file.访问Web资源，你必须明确地加入端点URL originUrl属性< 信任 >元素或内部的政策文件。
Low低
Intended to model the concept of a read-only application with no network connectivity.模型与没有网络连接的只读应用程序的概念。
Read only access for file I/O within the application's virtual directory structure.只读文件访问的I / O在应用程序的虚拟目录结构。
Minimal最小
Execute only.只执行。
No ability to change the IPrincipal on a thread or on the HttpContext .没有能力改变一个线程的 HttpContext 的 IPrincipal。
If your application calls unmanaged code, it must run with Full trust.如果您的应用程序调用非托管代码，它必须运行的完全信任。 Even the least restrictive partial trust level, High, does not permit calls to unmanaged code.即使是限制最少的部分信任的水平，高，不允许调用非托管代码。
To choose an appropriate trust level 要选择一个合适的的信任级别
1. Examine each trust level, beginning with High trust.检查每个信任级别，高信任的开始。
2. Look inside the High trust policy file, web_HighTrust.config.往里高信任的政策文件，web_HighTrust.config。
3. If your application requires fewer code access security permissions than those provided by the High trust level, move on to consider Medium trust.如果应用程序需要比高信任级别提供的代码访问安全权限少，考虑中等信任。
4. Repeat the process, moving from Medium to Low to Minimal, and keep evaluating the partial trust levels until you reach an exact match to your application's requirements or until your application's required permissions slightly exceed a partial trust level.重复这个过程中，由中等至低到最小，并保持评估的部分信任的水平，直到到达一个完全匹配您的应用程序的要求，或您的应用程序所需的权限，直到略超过部分信任水平。
This process will help you to identify a trust level that matches your application's code access security permission requirements as closely as possible but does not grant permissions that your application does not need.这一过程将帮助您识别匹配您的应用程序的代码访问安全权限要求尽可能接近但不授予权限，您的应用程序并不需要的信任级别。
Step 3.第3步。 Configure Your ASP.NET Application配置您的ASP.NET应用程序
You can configure your ASP.NET application to use a standard trust level either in your application's Web.config file or in the machine-level Web.config file.你可以配置你的ASP.NET应用程序在您的应用程序的Web.config文件中或在计算机级别的Web.config文件中使用标准的信任级别。 Machine-level configuration affects all the ASP.NET Web applications and Web services hosted on that server.机级别的配置影响到所有的ASP.NET Web应用程序和Web服务的服务器上宿主。 Application-level configuration affects only a specific application.应用程序级配置只影响特定的应用程序。
For machine-level configuration, you make changes to the Web.config file located in the following directory: %windir%\Microsoft.NET\Framework\{version}\CONFIG\.机器级别的配置，您修改Web.config文件位于以下目录：％WINDIR％\ Microsoft.NET \框架\ {版本} \ CONFIG \。
For application-level configuration, you make changes to the Web.config file located in your application's virtual directory root.应用程序级的配置，你让位于你的应用程序的虚拟根目录下的Web.config文件进行更改。
The following example shows how to configure your application for Medium trust.以下示例显示了如何配置您的应用程序，为中等信任。
... ... ...
<system.web>的<system.web>
... ... ...
<trust level="Medium" originUrl="" /> <trust level="Medium" originUrl="" />
... ... ...
</system.web> </的system.web>
... ... ...

Step 4.第4步。 Optionally Create a Custom Trust Level选择创建一个自定义的信任级别
You may require a custom trust level if none of the predefined trust levels provide the exact set of permissions that your application needs to run.您可能需要一个自定义的信任级别，如果没有预定义的信任级别提供确切的设置，您的应用程序需要运行的权限。 For example, you may find that your application needs more permissions than Medium trust provides but fewer permissions than High trust provides.例如，您可能会发现，比中等信任你的应用需要更多的权限，但较少的权限比高度信任提供。
Customizing Trust Level Policy自定义信任级别政策
With this approach you do the following:通过这种方法，你做到以下几点：
1. Copy one of the existing trust level policy files to create a custom policy file.复制一个现有的信任级别政策文件创建一个自定义的政策文件。
2. Add the required permissions to the custom policy file.添加自定义策略文件所需的权限。
3. Configure your application to run using the custom policy.配置您的应用程序运行时使用的自订政策。
Note You are unlikely to be able to use this approach to customize the trust level in hosted environments, where policy restrictions are likely to be rigid. 注意 ：您不太可能能够使用这种方法，自定义在托管环境中的信任水平，政策限制，有可能是僵化。
If you can customize policy, this is the preferred option because it does not require any development effort.如果您可以自订的政策，这是首选的选择，因为它不需要任何开发工作。
In the following example, the application requires all the permissions provided by Medium trust.在以下示例中，应用程序需要中等信任所提供的所有权限。 In addition, it needs unrestricted access to the Windows registry.此外，它需要无限制地访问Windows注册表。 While High trust provides unrestricted registry access, it also provides permissions that you may not want to grant to your application, such as unrestricted file I/O access.而高信任提供不受限制的注册表访问，它也提供了，你可能不希望您的应用程序，如无限制的文件I / O访问，授予的权限。 This is the type of situation where you should consider creating a custom trust level.这类型的情况下，您应该考虑创建一个自定义的信任级别。
To create the custom trust level configuration file 要创建自定义信任级别的配置文件
1. Copy the Medium trust policy file, web_MediumTrust.config, which is located in the %windir%\Microsoft.NET\Framework\{version}\CONFIG\ directory to a file named Web_CustomTrust.config in the same directory.复制web_MediumTrust.config，中等信任的政策文件，这是位于在％windir％\ Microsoft.NET \框架\ {版本} \ CONFIG \目录命名在同一目录中Web_CustomTrust.config的文件。
2. Add the RegistryPermission security class definition to the < SecurityClass > section in the Web_CustomTrust.Config file, as shown in the following example. RegistryPermission的安全类定义添加<SecurityClass>部分在Web_CustomTrust.Config文件中，如下面的示例所示。
3. <SecurityClass Name="RegistryPermission" <SecurityClass名称=“RegistryPermission的”
4. Description="System.Security.Permissions.RegistryPermission,描述=“System.Security.Permissions.RegistryPermission
5. mscorlib, Version=2.0.0.0, Culture=neutral, mscorlib程序，版本= 2.0.0.0，文化=中立，
6. PublicKeyToken=b77a5c561934e089"/>于PublicKeyToken = b77a5c561934e089“/>

7. Add the unrestricted RegistryPermission to the "ASP.Net" named permission set.不受限制的RegistryPermission的 “ASP.Net”命名的权限集。
8. <PermissionSet <PermissionSet中
9. class="NamedPermissionSet"类=“NamedPermissionSet”
10. version="1"版本=“1”
11. Name="ASP.Net">名称=“ASP.Net”>
12. ... ... ...
13. <IPermission <IPermission
14. class="RegistryPermission"类=“RegistryPermission的”
15.