dotnet security: I am referencing the NUnit libraries in an assembly that is hosted by a COM+
application. Within NUnit it creates a "runner" app domain and then calls
CreateInstanceAndUnwrap to create an instance of a class within a unit test
assembly. I get a SecurityException on this method when it is executed
within the bounds of a COM+ application, even though it is actually in a .NET
assembly.

If I refernce the same NUnit libraries and the same assembly calls them but
is hosted in a .NET forms application I do not get any SecurityExceptions on
the CreateInstanceAndUnwrap call.

I've tried several imperative and declaritve security options at the
assembly, class and method levels but so far nothing has worked. Has anyone

Here is the full stack trace:
==========================
Server stack trace:
at System.RuntimeType.CreateInstanceImpl(Boolean publicOnly)
at System.Activator.CreateInstance(Type type, Boolean nonPublic)
at System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder
binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
at System.Activator.CreateInstance(Type type, BindingFlags bindingAttr,
Binder binder, Object[] args, CultureInfo culture, Object[]
activationAttributes)
at System.Activator.CreateInstance(String assemblyName, String typeName,
Boolean ignoreCase, BindingFlags bindingAttr, Binder binder, Object[] args,
CultureInfo culture, Object[] activationAttributes, Evidence securityInfo,
StackCrawlMark& stackMark)
at System.Activator.CreateInstance(String assemblyName, String typeName,
Boolean ignoreCase, BindingFlags bindingAttr, Binder binder, Object[] args,
CultureInfo culture, Object[] activationAttributes, Evidence securityInfo)
at System.AppDomain.CreateInstance(String assemblyName, String typeName,
Boolean ignoreCase, BindingFlags bindingAttr, Binder binder, Object[] args,
CultureInfo culture, Object[] activationAttributes, Evidence
securityAttributes)
at System.AppDomain.CreateInstanceAndUnwrap(String assemblyName, String
typeName, Boolean ignoreCase, BindingFlags bindingAttr, Binder binder,
Object[] args, CultureInfo culture, Object[] activationAttributes, Evidence
securityAttributes)
at
System.Runtime.Remoting.Messaging.StackBuilderSink.PrivateProcessMessage(MethodBase
mb, Object[] args, Object server, Int32 methodPtr, Boolean fExecuteInContext,
Object[]& outArgs)
at
System.Runtime.Remoting.Messaging.StackBuilderSink.SyncProcessMessage(IMessage msg, Int32 methodPtr, Boolean fExecuteInContext)
=============================

The Nunit code is actually creating the app domain but I do have the source
so I can change it if necessary. I don't know that any app domain policies
are being applied but I will look into this. Would I look for this using
caspol or through the "Microsoft .NET Framework 1.1 Configuration" tool? The
evidence for the new domain is created from the evidence from the
currentdomain.

Evidence baseEvidence = AppDomain.CurrentDomain.Evidence;
Evidence evidence = new Evidence(baseEvidence);

Let me know if this is not enough information and I can see if I can put
together a small code sample. The one real hitch in this is that the COM+
application that is hosting the .NET assemblies is Groove and I probably
cannot even attempt to represent it in code.

[quoted text, click to view]