ASP.NET中的安全异常和IIS 7.5中的加载用户配置文件选项 [英] Security exceptions in ASP.NET and Load User Profile option in IIS 7.5

问题描述

在新版本的ASP.NET 2.0应用程序部署之后，它开始引发安全异常：System.Security.SecurityException：请求System.Web.AspNetHostingPermission，System，Version = 2.0.0.0类型的权限，文化=中立，PublicKeyToken = b77a5c561934e089失败。

After deployment of new version of our ASP.NET 2.0 application, it started to raise security exception: „System.Security.SecurityException: Request for the permission of type 'System.Web.AspNetHostingPermission, System, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.".

经过对互联网的快速研究，我们能够通过将加载用户个人资料设置为True来解决这个问题IIS 7.5应用程序池。这个解决方案在stackoverflow上也多次提及：

After quick research on internet we were able to resolve this isse by setting „Load User Profile" to True in IIS 7.5 application pool. This solution is also mentioned several times here on stackoverflow:

• 奇怪的ASP.NET错误！


• System.Web.AspNetHostingPermission新部署的例外


• 在IIS7上运行asp.net Web应用程序项目会抛出异常

• Strange ASP.NET error !
• System.Web.AspNetHostingPermission Exception on New Deployment
• Running a asp.net web application project on IIS7 throws exception

然而，我们无法找到为什么它是真的。我们审查了新版本中的所有更改（很高兴只有几个），但没有发现任何可疑（无法访问注册表或临时数据，因为某些文章建议等）。当IIS 7.5中托管的ASP.NET应用程序需要加载用户配置文件选项设置为True时，任何人都可以提供提示？

However we were unable to find reason why it has to be true. We reviewed all changes in new version (gladly there were only a few), but didn’t find anything suspicious (no access to registry or temp data as some articles suggested etc). Could anybody give us hints when an ASP.NET application hosted in IIS 7.5 needs „Load User Profile" option set to True?

详细信息：

• 应用程序池：.NET 2.0;管理模式 - 经典;身份 - 自定义域帐户


• 在IIS 6.0（W2K3）中：旧的和新的
  版本的应用程序工作正常


• 在IIS 7.5（ W2K8-R2）：旧版本的
  应用程序工作正常;新版本
  的应用程序引发安全性
  异常 - 在
  之后开始工作，将加载用户配置文件设置为True

谢谢！

编辑：
我们终于找到了这个问题的原因！我们的管理员使用不同的技术将新版本的应用程序从分段环境复制到生产环境。他用web服务器作为中介。在将发布构建工件压缩到生产环境，然后解压缩文件之后，它们仍被标记为阻止，因为它们来自不同的计算机。另请参阅 https://superuser.com/questions/38476/this-file-came-from-another-computer-how-can-i-unblock-all-the-files-in-a 。 ASP.NET然后在部分信任中逻辑地执行这些二进制文件，而不是完全信任，这实际上是在我们的应用程序中引起了提到的安全异常。

We have finally found the cause of this problem! Our admin used different technique to copy the new version of application from staging environment to production environment. He used web server as intermediary. After donwloading zipped release build artifacts to production environment and then unzipping the files, they were still marked as "blocked" because they came from different computer. See also https://superuser.com/questions/38476/this-file-came-from-another-computer-how-can-i-unblock-all-the-files-in-a. ASP.NET then logically executes these binaries in partial trust instead of full trust and that was actually causing mentioned security exceptions in our application.

将加载用户配置文件设置为True可将安全例外设置为副作用。如果加载用户配置文件设置为False，那么我们的应用程序（不是我们的代码，也许是一些.NET BCL或外部程序集）试图查询有关目录C：\Windows\System32\config\ systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files应用程序池的身份不允许：

Setting "Load User Profile" to True fixed the security exceptions as a side-effect. If "Load User Profile" is set to False, then our application (not our code, maybe some .NET BCL or external assembly) is trying to query basic info about directory "C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files" which the identity of application pool is not allowed to:

<完全信任：对此查询操作的访问被拒绝不会引发任何异常

• 部分信任：对该查询操作的访问被拒绝引发安全异常

如果加载用户配置文件设置为True，则每次应用程序池启动时都会创建Users目录中的临时配置文件。然后我们的应用程序尝试查询有关此配置文件的Temporary Internet Files目录的信息，该应用程序池的身份被允许。因此，即使有部分信任也没有例外。

If "Load User Profile" is set to True, then temporary profile in Users directory is created every time when application pool starts. Our application is then trying to query info about "Temporary Internet Files" directory of this profile, which the identity of application pool is allowed to. Thus no exception is raised even with partial trust.

真的很好的故障排除会话！ ：）

Really nice troubleshooting session! :)

推荐答案

加载用户配置文件设置可以帮助您使用临时文件的另一个示例。有时这个用法可以是间接的。例如，SQL Express可以在某些情况下执行此操作。

One more example when "Load User Profile" setting could helps you is usage of temporary files. Sometime this usege can be indirect. SQL Express for example can do this in some situations.

所以我的建议。关闭加载用户配置文件，并检查％TEMP％。然后尝试给用于应用程序池的域帐户完全访问（或更改访问权限）到％TEMP％的目录。可能会解决您的问题。

So my advice. Switch off "Load User Profile" and examine %TEMP%. Then try to give domain account used for application pool the full access (or change access) to the directory from %TEMP%. Probably it fix your problem.

另外一个建议是使用Process Monitor（请参阅 http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx ）到用户配置文件的哪些部分将被使用（或接收当您收到System.Security.SecurityException：请求类型System.Web.AspNetHostingPermission异常的权限时，访问被拒绝错误。

One more advice is usage of Process Monitor (see http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx) to locale which parts of user profile will be used (or receive "access denied" error) at the moment when you receive "System.Security.SecurityException: Request for the permission of type 'System.Web.AspNetHostingPermission" exception.

这篇关于ASP.NET中的安全异常和IIS 7.5中的加载用户配置文件选项的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！