Thursday, 29 June 2006

log4Net and ASP.Net Medium Trust

I'm writing an an ASP 2 application and I wanted to add loggin functionallity via log4Net. In ASP.Net you configure log4Net by adding a new config section to the web.config file, log4Net can then read this configuration via a call to XmlConfigurator.Configure() placed in the Application_Start event.

This all works if the ASP.Net application is run in full trust, however I want my app to work in medium trust (otherwise Dominick will send the boys around) and this proved more difficult. The problem is that log4Net uses the new Configuration APIs and these demand the System.Configuration.ConfigurationPermission which is medium trust fails.

After a few false starts I found the answer in Stefan Schackow's excellent book Professional ASP.Net 2.0 Security, Membership and Role Management. In ASP.Net 2.0 there is a new attribute you can add to the section element in web.config, the attribute is requirePermission, setting this to false stops the configuration APIs demanding permissions. My log4net section now looks like this 

  <configSections>
    <section name="log4net" type="log4net.Config.Log4NetConfigurationSectionHandler, log4net"  requirePermission="false"/>
  </configSections>
and log4net now works in medium trust.

Posted by kevin at 10:47 PM in Net

Responses (2)

 

Comment: dominick at Sun, 1 Jul 9:44 AM

Well -

asking me - or at least reading my blog - would have been faster :P

http://www.leastprivilege.com/ConfigurationPermissionAndRequirePermission.aspx

Comment: perica at Sun, 1 Jul 9:44 AM

And it works! Too bad I didn't find this last night, I was trying to figure this out until 2AM :)

thanks!

Your comment:

SCode: (*) Generate another code
SCode

Please enter the code as seen in the image above to post your comment.

(not displayed)
 
 
 

Live Comment Preview:

 
« June »
SunMonTueWedThuFriSat
    123
45678910
11121314151617
18192021222324
252627282930