<SOLVED> .NET interop failing in combination with AllowPartiallyTrustedCallers

fdu

Hello everyone,

we have been using RazorEngine for html document templating successfully from within 2009 and 2015.
We are currently upgrading to 2016 and interop doesn't seem to work anymore because of security reasons.

Please excuse I can only provide the error thrown in German.

Microsoft Dynamics NAV
---------------------------

Fehler bei einem Aufruf von TemplateEngine.TemplateEngine.Render mit folgender Meldung: Fehler beim Versuch der SecurityTransparent-Methode "RazorEngine.Engine.get_IsolatedRazor()", auf die sicherheitskritische Methode "RazorEngine.Templating.IsolatedRazorEngineService.Create()" zuzugreifen.

Die Assembly "RazorEngine, Version=3.7.7.0, Culture=neutral, PublicKeyToken=9ee697374c7e744a" ist mit "AllowPartiallyTrustedCallersAttribute" markiert und verwendet das Sicherheitstransparenzmodell der Stufe 2. Bei Festlegung der Transparenz auf Stufe 2 werden alle Methoden in AllowPartiallyTrustedCallers-Assemblys standardmäßig sicherheitstransparent, was die Ursache der Ausnahme sein kann.
---------------------------
OK
---------------------------

After investigation I found out that RazorEngine uses AllowPartiallyTrustedCallersAttribute (see Isolation API), which doesn't seem to play nicely with 2016.

// We have to load Razor with full trust (so all methods are SecurityCritical)
// This is because we apply AllowPartiallyTrustedCallers to RazorEngine, because
// We need the untrusted (transparent) code to be able to inherit TemplateBase.

I want to avoid forking the project and rewriting the relevant parts, which might actually be impossible to do.

Is this a known problem and can anyone provide a solution?

fdu

For anyone finding this thread, I think I've found a solution to the problem.

Assemblies running in AllowPartiallyTrustedCallers mode are supposed to be run with full trust. As I deployed the assembly via copy & paste to the remote machine, the assembly owner was my domain user rather than the target machine itself - which in turn disallowed full trust mode.

Setting the assembly owner to either 'Everyone', or to the local machine solved the issue.

Thanks @kriki for moving this thread.

kriki

[Topic moved from 'NAV Tips & Tricks' forum to 'NAV Three Tier' forum]

fdu

For anyone finding this thread, I think I've found a solution to the problem.

Assemblies running in AllowPartiallyTrustedCallers mode are supposed to be run with full trust. As I deployed the assembly via copy & paste to the remote machine, the assembly owner was my domain user rather than the target machine itself - which in turn disallowed full trust mode.

Setting the assembly owner to either 'Everyone', or to the local machine solved the issue.

Thanks @kriki for moving this thread.