dotnet security: Automating the roll-out of permission sets & code groups -- dotnet security

You're in the

dotnet security

group:

Automating the roll-out of permission sets & code groups

ssg31415926
6/20/2007 7:53:34 AM

dotnet security: I need to roll out a permission set and add a url to the Trusted zone
group. I was planning to use caspol.exe but I'm getting inconsistent
results with zone numbers. Specifically, caspol -listgroups returns
this on my PC (I've removed the strong name key):

Code Groups:
1. All code: Nothing
1.1. Zone - MyComputer: FullTrust
1.1.1. StrongName - <removed>: FullTrust
1.1.2. StrongName - <removed>: FullTrust
1.2. Zone - Intranet: LocalIntranet
1.2.1. All code: Same site Web
1.2.2. All code: Same directory FileIO - 'Read, PathDiscovery'
1.3. Zone - Internet: Internet
1.3.1. All code: Same site Web
1.4. Zone - Trusted: Internet
1.4.1. All code: Same site Web
1.5. Zone - Untrusted: Nothing

On another PC, 1.4 and 1.5 are reversed. I was planning to use this
command line to roll out the addition:

caspol.exe -addgroup 1.5 -url http://serverName/* NewPermSet

If they're not consistent, how can I roll out my addition?

SSG

Re: Automating the roll-out of permission sets & code groups

Nicole Calinoiu
6/21/2007 12:42:00 PM

Caspol allows groups to be referenced by names as well as by numeric id
(even if there are no relevant examples in the docs).

[quoted text, click to view]

Re: Automating the roll-out of permission sets & code groups

ssg31415926
6/25/2007 3:07:42 AM

Thanks for the reply. I did see that in the help but I couldn't get
it to work. It wasn't clear from the help if it applied to this
specific command. Are you sure that it does?

On 21 Jun, 17:42, "Nicole Calinoiu" <calinoiu REMOVETHIS AT gmail DOT
[quoted text, click to view]

Re: Automating the roll-out of permission sets & code groups

ssg31415926
6/26/2007 7:52:22 AM

Fixed! The problem is that caspol -listgroups doesn't display the
zone names that you need to use with caspol -addgroup. To find out
the correct zone names, use the Microsoft .NET Framework 2.0
Configuration Administrative Tool.

E.g. caspol -listgroups displays
:
1.3. Zone - Internet: Internet
1.3.1. All code: Same site Web
1.4. Zone - Trusted: Internet
1.4.1. All code: Same site Web
:

But if you want to modify the Trusted zone, you can't use "Trusted" as
the zone name. Instead, you have to use "Trusted_Zone". E.g. this
command line works:

caspol.exe -addgroup Trusted_Zone -url http://webserver1/* NewPermSet -
name NewCodeGroup -description "Additional permissions required by the
webserver1 IE component"

Displays "Trusted" but requires "Trusted_Zone". What was the
developer thinking?

SSG

[quoted text, click to view]

Got something to say? Click here to post a reply to this thread.

Don't see what you're looking for? Try a search.

View other messages in the dotnet security group.

home · blog · groups

Questions? Comments? Contact the dn