Full Trust required for the ASP.Net control

[ianhaynes]

In trying to install the ASP.Net component on a shared server I'm getting a security error because the control needs to run in a Full Trust enviroment.

This seems unecessary given that it only reads the data files and doesn't modify them (as far as I understand it).

Ian

[David]

You need control of the machine to do the initial install of the control.

The control also has potential to write log files, if you turn on these settings.

[ianhaynes]

Surely installing the control doesn't require anything more than uploading to the Bin folder, it doesn't need installing via the tool does it?

Can report writing be turned off in order to run in Partial Trust?

Ian

[Ray]

The ASP.NET Server Control must be installed with the MSI package provided. Simply copying the contents of the Bin folder will not install the control. This is documented in the Users Guide.

The control uses unmanaged C++ code and C Run-time libraries. It is largely due to these dependencies and the need to register the control with the server that such installation procedures are necessary.

You can disable search word logging via "Configure"->"Advanced" and unchecking the option to "Log the searches made on your site". You must re-index for your index to take effect.

I am not sure whether changing this setting will alter the ability of the control to run in Partial Trust or not. I didn't think IIS would alter its trust requirements depending on the actions of the application. We have not tested the current ASP.NET Server Control to run under Partial Trust settings, and my understanding is that you must use Full Trust settings to call unmanaged code.

You could consider using the PHP, or Classic ASP option if you do not require the lower-level execution capabilities of the C++ implementation (i.e. faster, less overhead, and ability to search more pages that is available with the ASP.NET Server Control and the CGI).

[ianhaynes]

OK, I understand, but this is a severe limitation for the component and it is unlikely that many hosts will allow it's use on shared servers.

I need to use it with a masterpage and looks like I am therefore limited to the JavaScript version. Disappointing.

Whilst you do refer to this in the documentation it by no means clear and I think you need to state this much more visibly.

Ian

[David]

This is the (daft) way Microsoft designed .NET. We would change it if we could.

But we expect people to read the documentation and test the software using the Free Edition we provide to determine if the software can work for them.

As we also support PHP, ASP, CGI and JavaScript, so it should work on pretty much any host.

[Ray]

We'll try to state the Full Trust requirements more visibly, and update our System Requirements page.

Having said that, few shared hosting companies would even allow you to install a custom Server Control. So we've had very few users request the need to run it under Partial Trust. Most people running custom ASP.NET server controls tend to have full access to their servers.

I need to use it with a masterpage and looks like I am therefore limited to the JavaScript version.

There are various ways to use one of the other platforms (PHP, Classic ASP, or CGI) within an ASP.NET page. We have an example here which demonstrates how you can call the CGI from within an ASP.NET page:
http://www.wrensoft.com/zoom/support/aspdotnet.html