ASP.NET Medium Trust Deployment Tips
If you've every tried deploying a web application to a Hosted Environment, I'm sure you've been forced to learn more about CLR permissions and security than you ever wanted to know. To put it simply, any assembly signed with a Strong Name Key demands that the calling assembly be fully trusted. While this sounds great in theory, it creates havoc when trying to get your Web Site up and running.
All Infragistics assemblies are Strong Named, which is why you are able to put them in the Global Assembly Cache (GAC). Because they have been given a strong name, Infragistics assemblies are placed into an elevated security level. When running in a medium trust environment, unsigned assemblies are placed in the medium trust zone. The mismatch that is created causes a security exception to be raised when the unsigned assembly attempts to call the Signed Infragistics Assemblies.
Fortunately, there are a few solutions to this problem.
- Create a proxy assembly which is used to call the Strong Named assemblies. Mark the proxy assembly with "AllowPartiallyTrustedCallers".
- Raise the Trust Level of your site to Full
- Remove the Strong Name from the necessary assemblies
- Add "[AllowPartiallyTrustedCallers]" attribute to all strong named assemblies
Of the solutions listed, you only have control over 1 and 3. The 2nd solution requires action to be taken by your Hosting Provider, which is unlikely. The 4th solution requires modification of the assemblies from the provider (ie. Infragistics). We are planning to add the AllowPartiallyTrustedCallers to our assemblies for the upcoming release, but in the mean time, I would recommend the 3rd solution - Remove the Strong Name from the necessary assemblies.
Removing a strong name from an assembly isn't as complicated as you might think. As a matter of fact, it's amazingly simple given the right tool. The first step is to download ILMerge (http://research.microsoft.com/~mbarnett/ILMerge.aspx). We will be taking advantage of an unfortunate side effect of using ILMerge - removal of the strong name key.
Once you have ILMerge installed, simply run it against each Infragistics Assembly individually. The usage is pretty straight forward, simply specify the source and destination file, and it will do its job. When you are done, you will have successfully stripped the assembly of its Strong Name.
The next step is to update your project. Since we've removed the strong name key from the assembly, you will need to go through all <%@ Register ..> directives pointing towards Infragistics assemblies, and remove the PublicKeyToken portion. Check your web.config as well, as there may be some references contained inside of the config. After you have stripped the PublicKeyToken string, add the now unsigned Infragistics assemblies to your bin directory and recompile. Deployment is now a just a matter of copying the files up.
The one drawback to this approach is that it may interfere with design-time functionality. Because of this, you may want to have a separate config file used for deployment, which clears all TagPrefixes and remaps them to the unsigned Infragistics Assemblies. By modifying the <%@ Register %> directives through the web.config instead of each of your ASPX pages, you can insure the fidelity of your design-time experience.
ILMerge is an amazing tool, with much more power than it is being used for in this context. If you haven't checked it out yet, I would definitely recommend you do so.