To set up a managed sproc to act as a WSE 3.0 web service client I had to register the following .Net DLLs as UNSAFE assemblies:
System.Configuration.Install.dll
System.Web.dll
Microsoft.Web.Services3.dll
In order to register UNSAFE assemblies I had to set the database's TRUSTWORTHY property to 'true'.
Can anyone tell me what are the implications of doing this?
I'm trying to create an audit database containing a log table, which will be filled with some info, according to the case. These info will be send from the db being audited and then saved in the audit db using service broker. Both databases are on the same instance.
Is it possible to have both databases set with trustworthy off? How to do that?
I've tried this:
1 - Create a certificate; 2 - Create a login from the certificate; 3 - Create an user in each database from that login and
4 - Alter the queue from db being audited, including the "execute as"
But I get this error: Cannot execute as the database principal because the principal "usrServiceBroker" does not exist, this type of principal cannot be impersonated, or you do not have permission.
5 - Impersonate these users, with no success. 6 - use execute as 'dbo' in the procedures related to the queues.
We have a curious situation on a SQL 2014 DB, with Trustworthy set to OFF. There is a job that runs a data export to a file via a CLR. The assembly as PERMISSION_SET = EXTERNAL_ACCESS, however there is no Asymmetric key for the assembly. Therefore what I trying to work out is why this is NOT failing. Some further information on this specific database that may or may not be relevant is:
1. It was upgraded a few weeks ago (Backup/Restore) from a SQL 2012 - SQL 2014 server 2. It as a Compatibility Level = 110 (2012) 3. The Previous 2012 database DID have Trustworthy ON 4. The CLR are actually being run against a snapshot of the database (Actually I think this one is a red herring. The SP is getting data from a table in the snapshot, but the CLR used it the one from the main DB)
We have a SQLServer 2012 Always-On Availability (AAG) Primary and Secondary Node installation/environments. On the Primary node, we have some databases that have the TRUSTWORTHY option enabled (Set to ON). But when the databases are synched/added to the AAG the databases loose the TRUSTWORTHY property and are reset to OFF on the Secondary Node.Because of this,When the instance fails over to the Secondary Node the applications that were working don’t work anymore.
I tried to create a sp on one of the databases on my lap top and got this: Pls help i need it bad
Msg 10314, Level 16, State 11, Procedure ap_Hello, Line 5
An error occurred in the Microsoft .NET Framework while trying to load assembly id 65695. The server may be running out of resources, or the assembly may not be trusted with PERMISSION_SET = EXTERNAL_ACCESS or UNSAFE. Run the query again, or check documentation to see how to solve the assembly trust issues. For more information about this error:
System.IO.FileLoadException: Could not load file or assembly 'vbtriggers, Version=0.0.0.0, Culture=neutral, PublicKeyToken=null' or one of its dependencies. An error relating to security occurred. (Exception from HRESULT: 0x8013150A)
I'm trying to create an "unsafe assembly": USE master GO
CREATE ASYMMETRIC KEY StoredProcedures_dll_Key FROM EXECUTABLE FILE = 'C:Documents and SettingsAll UsersDocumentshunterStoredProcedures.dll';
CREATE LOGIN StoredProcedures_dll_Login FROM ASYMMETRIC KEY StoredProcedures_dll_Key;
GRANT EXTERNAL ACCESS ASSEMBLY TO StoredProcedures_dll_Login; GO
USE gfx_sa GO
CREATE ASSEMBLY hunter_storedProcedures FROM 'C:Documents and SettingsAll UsersDocumentshunterStoredProcedures.dll' WITH PERMISSION_SET = UNSAFE; GO
CREATE PROCEDURE [dbo].[hunter_storedProcedure1] ( @symbol_id as int ) AS EXTERNAL NAME hunter_storedProcedures.StoredProcedures.StoredProcedure1 GO
But on 'CREATE ASSEMBLY" clause I'm getting error: Msg 0, Level 11, State 0, Line 0 A severe error occurred on the current command. The results, if any, should be discarded. Msg 0, Level 20, State 0, Line 0 A severe error occurred on the current command. The results, if any, should be discarded.
I created a SQL Server Project in VS 2005, and tried to add a reference to SQLDMO Object dll. But the reference --> add reference, does not allow it. It does not work, even if I set the Assembly Permission Level to UNAFE/EXTERNAL ACCESS.
Reason I'm trying to do this:
We have a SQL 2000 stored procedure that uses SQLDMO using sp_OACreate to BCP files to database. We are converting to 2005 and because of SOX restrictions, I'm trying to replace the sp_OACreate part with external stored procedure written in C#.
According to BOL, I thought atleast UNSAFE should support this, but it seems not.
I think I have some kind of permission problem. But first things first:
I have code which I would like to run in SQL Server (CLR Integration). First thing is that my code uses third-party-dll. I have to deploy my code as unsafe because of
"
CREATE ASSEMBLY failed because method "add_FunctionAdd" on type "USP.Express.Pro.FunctionsCollection" in safe assembly "USP.Express.Pro.2.0" has a synchronized attribute. Explicit synchronization is not allowed in safe assemblies. "
Of course I can not create "asymmetric key" for third-party-dll (Or can I?).
So, I tried to use trustworthy DB. But I get all the time error Msg 10327: "Assembly is not authorised for PERMISSION_SET=UNSAFE"
I am using Windows Login to log on Sql Server. Login is granted "Unsafe assembly" and DB has trustworthy setting "on".
Login has server roles "sysadmin" and "securityadmin". Login is mapped with DB User who has same name ( DOMAINUserName ) and has default schema "dbo". Login has DB memberships "db_owner" and "db_securityadmin". DB user owns schemas "db_owner" and "db_securityadmin".
Am I missing something?
Interesting thing is that I can do deployment (as unsafe assembly) in master-database. But not in the other databases.
Questions are: - Is there other way to authorise third-party-dll than using trustworthy? - Why deployment can be done in master-database?
And finally: - Why deployment can not be done in other database?
I develop a database that notifies clients when data changes by sending an UDP broadcast message using an extended stored procedure. Now I want to use a CLR stored procedure to send the UDP broadcast instead:
using System;
using System.Data.SqlTypes;
using Microsoft.SqlServer.Server;
using System.Net.Sockets;
public partial class UserDefinedFunctions
{
[SqlProcedure]
public static void UdpSend(SqlString address, SqlInt32 port, SqlString message)
{
System.Net.Sockets.UdpClient client = new System.Net.Sockets.UdpClient();
I have found that to be allowed to send to 255.255.255.255 I must give the assembly permission set 'Unsafe'. If I change to 'External access' I get:
Msg 6522, Level 16, State 1, Procedure UdpSend, Line 0
A .NET Framework error occurred during execution of user defined routine or aggregate 'UdpSend':
System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.SecurityPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.
System.Security.SecurityException:
at System.Security.CodeAccessSecurityEngine.Check(Object demand, StackCrawlMark& stackMark, Boolean isPermSet)
at System.Security.CodeAccessPermission.Demand()
at System.Net.Sockets.Socket.CheckSetOptionPermissions(SocketOptionLevel optionLevel, SocketOptionName optionName)
at System.Net.Sockets.UdpClient.CheckForBroadcast(IPAddress ipAddress)
at System.Net.Sockets.UdpClient.Send(Byte[] dgram, Int32 bytes, String hostname, Int32 port)
at UserDefinedFunctions.UdpSend(SqlString address, SqlInt32 port, SqlString message)
I cannot use permission set 'Unsafe' in production environment, so what I want is to customize the effective permissions with higher resoloution than the three pre-defined permission sets 'Safe', 'External access' and 'Unsafe'. Except from what is allowed by 'Safe' I only want the permissions necessary to send an UDP broadcast.
I have to make a gateway to access third-party closed-source native-code COM objects. As an interface, SQL Server stored procedures are absolutely perfect for my needs. I decided to use SQL Server 2005 CLR rather than using deprecated extended stored procedures or accessing COM objects directly through SQL Server. (This decision is aided by the fact that the third party has plans to make a .NET version of their COM objects "really soon now" (i.e.: not soon enough). Backporting their new interface to my abstraction layer will be very simple.)
I'm having problems using these COM objects from my SQL Server 2005 CLR stored procedure. When I try to run my stored procedure, I get the error below. It appears that SQL Server/CLR refuses to perform the disk access necessary to load the COM object from disk so that it can instantiate it. (My message continues after the error.)
Msg 6522, Level 16, State 1, Procedure MyStoredProcedure, Line 0 A .NET Framework error occurred during execution of user defined routine or aggregate 'MyStoredProcedure': System.IO.FileLoadException: LoadFrom(), LoadFile(), Load(byte[]) and LoadModule() have been disabled by the host. System.IO.FileLoadException: at System.Reflection.Assembly.nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, Assembly locationHint, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection) at System.Reflection.Assembly.InternalLoad(AssemblyName assemblyRef, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) at System.Reflection.Assembly.InternalLoadFrom(String assemblyFile, Evidence securityEvidence, Byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm, Boolean forIntrospection, StackCrawlMark& stackMark) at System.Reflection.Assembly.LoadFrom(String assemblyFile, Evidence securityEvidence, Byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm) at System.Activator.CreateComInstanceFrom(String assemblyName, String typeName, Byte[] hashValue, AssemblyHashAlgorithm hashAlgorithm) at System.Activator.CreateComInstanceFrom(String assemblyName, String typeName) at UserDefinedFunctions.MyStoredProcedure() .
I'll outline the steps I performed so far to get the assembly working: Ensured I was running at SQL Server 2005 compatibility level. (90) - Installed and configured the third-party COM objects on my devel box and my DB box. They registered themselves properly. - Enabled CLR in the DB. - Made sure the DB owner has UNSAFE ASSEMBLY permission. - Added the TRUSTWORTHY property to the DB. (Yes, this isn't the "correct" way to do it, but I didn't want to deal with code-signing voodoo. Apologies to actual believers in voodoo.) - Created an Unsafe assembly "MyAssembly" in SQL Server 2005 and Visual Studio 2005. - Created all the necessary Interop assemblies (by creating a normal (non-SQL) C# project and building my code, and raiding the bin directory). - Added these Interop assemblies to SQL Server 2005 as Unsafe assemblies. - In VS2005, built my SQL Project code and deployed successfully. - Tried running my stored procedure through a Query window, and I got the error above.
I've done many searches. All of the results I've found concern themselves with Web Services and XML serialization, and suggest using sgen.exe. I don't think they're relevant to my problem. A few said I should add my COM DLLs as assemblies to SQL Server, but that is impossible for native code DLLs. I found something that hinted at tblexp.exe, but I didn't understand how that could help me. I already figured out a way to get me the Interop libs.
Efforts at solving: - Reading webpages for hours on end. - I tried using sgen.exe to create the XML serialization assembly, but it didn't help. - I tried adding various native-code DLLs directly as SQL Server assemblies, but you can bet it didn't like that. - A few other pitiful attempts not worth mentioning. - Reading this forum. I didn't see anything that applied. - Posting here.
I really wish Microsoft had meant what they said when they stated that "Unsafe" assemblies can access anything, instead of trying to protect developers from their folly.
Any insights on getting those COM objects to work in my CLR stored procedure? Thank you.
Can someone verify that an assembly containing an interface with an event definition, such as...
public interface A { event EventHandler Foo; }
... can never be loaded under SAFE or EXTERNAL_ACCESS ?
It appears that the compiler-generated add_xxx and remove_xxx have the MethodImpl(MethodImplOptions.Synchronized) attribute defined by default, and "Explicit synchronization is not allowed". The same limitation also applies to classes by default, although technically one is able to define the implementation directly (clearly not ideal).
I wrote an assembly and attached to a trigger in one of my tables. It works as I expected, but then I decided to modify the code, say adding some new triggers that I will use with other tables. Then I realize that in order to update my new version of the assembly in SQL first I need to remove the trigger in the table, then remove the assembly, add the new version and finally run a script to create the trigger again in the table.
How could I avoid going through all this process everytime I want to update my assembly?
I am running a CLR stored proc that goes to an EDS (Novell) server with LDAP and returns records into a SQL table.
I am using the Novell ldap library.
I want to do this with SSL so my code referneces the Mono security library as well.
However when I make the call to the stored proc to run in SSL, I get an object not found error. I do not think that the the Novell assembly can "find" the Mono assembly.
Two points: 1/ I can do the SSL if I run it as an asp.net page (so I know the SSL works) 2/ The proc runs and pulls all the records in non-SSL (so I know the proc works)
i found one tutorial on self signing assemblies for use in sql server, but it appears to have errors. does anyone know of a better tutorial on this topic? the site im currently looking at is here: http://www.sqljunkies.com/WebLog/ktegels/articles/SigningSQLCLRAssemblies.aspx
I have a question: how is it planned to replicate changes made to the assemblies and to the CLR functions or UDT? Will Visual Studio deploy change of the Assembly as ALTER not DROP/CREATE?
How does SQL Server 2005 handle the replication of assemblies? I get the following when trying to replicate an assembly:
Timestamp: 6/15/2007 9:41:33 AM Message: HandlingInstanceID: 05eaed53-b6be-42da-8c72-0f91fcbfa5b6 An exception of type 'Microsoft.SqlServer.Replication.ComErrorException' occurred and was caught. ------------------------------------------------------------------------------------------------- 06/15/2007 09:41:33 Type : Microsoft.SqlServer.Replication.ComErrorException, Microsoft.SqlServer.Replication, Version=9.0.242.0, Culture=neutral, PublicKeyToken=89845dcd8080cc91 Message : The schema script 'StratisDSonetd85d6e89_1061.sch' could not be propagated to the subscriber. Source : Merge Replication Provider Help link : ErrorMessage : Unspecified error InterfaceId : 00000000-0000-0000-0000-000000000000 HelpFile : HelpContext : 0 Description : The schema script 'StratisDSonetd85d6e89_1061.sch' could not be propagated to the subscriber. ComHResult : -2147467259 ErrorCode : -2147467259 Data : System.Collections.ListDictionaryInternal TargetSite : Void Run() Stack Trace : at Microsoft.SqlServer.Replication.MergeSynchronizationAgent.Run() at Microsoft.SqlServer.Replication.MergeSynchronizationAgent.Synchronize() at SQLClientSync.SQLClientSync.Replicate() Additional Info: MachineName : REPCLIENT TimeStamp : 6/15/2007 1:41:33 PM FullName : Microsoft.Practices.EnterpriseLibrary.ExceptionHandling, Version=1.1.1.1, Culture=neutral, PublicKeyToken=d2ff10320a77ec18 AppDomainName : sqlclientsync.exe ThreadIdentity : WindowsIdentity : REPCLIENTAdministrator
I appears that the initial replication of the assembly was fine, when re-running the sync (no changes to the assembly), this error is generated.
I need to dynamically create a ADO.NET connection manger
so, my question is if it is safe to create it with the string that is generated (ConnectionManagerType) when creating the connection manager manually on my PC.
I understood that this string is the full qualified name of the assembly, so will it be different when I create it on another P.C or it is fixed on all P.Cs ?
I have followed the steps outlined in the knowledge base article http://support.microsoft.com/kb/913668 for effecting Xml Serialization within the SQL CLR. That is, I have
1. Prebuilt the serialization assembly X.Serializers for the types in assembly X and,
2. Registered both assemblies with SQL Server via the create assembly directive
Yet, when I attempt to create an XmlSerializer on the basis of one of the types defined in X, SQL CLR ignores the pre-built serialization assembly and attempts to dynamically create/load the assembly. Since dynamic loading is disallowed, this fails with the expected exception:
System.InvalidOperationException: Cannot load dynamically generated serialization assembly. In some hosting environments assembly load functionality is restricted, consider using pre-generated serializer. Please see inner exception for more information. ---> System.IO.FileLoadException: LoadFrom(), LoadFile(), Load(byte[]) and LoadModule() have been disabled by the host.
Where is it documented what the list of approved assemblies are for SQL 2005. Also, is there a way via T-SQL, or other means to get it programatically?
I'm building a SQL function from C++ and compile my assembly with /clrafe. After that I create the assembly with SAFE permission sets and create the function, both in SQL. But the server don't accept load or execute the function because of permission error. It says:
Code Snippet
"An error occurred in the Microsoft .NET Framework while trying to load assembly id 65561. The server may be running out of resources, or the assembly may not be trusted with PERMISSIONSET = EXTERNALACCESS or UNSAFE. Run the query again, or check documentation to see how to solve the assembly trust issues."
Does the terminology coince with the technology, or is it diffrent "safety" conditions we are speaking about? One for the SQL permission set, and another safety for CLR type-safe assemblies?
Anyway, after playing around a bit, and following the tricks from this thread. I managed to load and execute the function, but only in UNSAFE permission (unrestricted mode?)
---8<----
My second question is can I use unrestricted mode for assembly compiled with /clr (mixed CLR)?
I'm asking, because I have some C source code that I want to reuse, and for this I can't be type-safe and therefore need to compile only with /clr (mixed CLR).
Should I go back to the plain C API in SQL 2000 to implement such function in SQL 2005, and ignore all new things in c++/CLR/.NET?
If you have any points to C++ sample code, then please forward this to me.
I have followed the steps outlined in the knowledge base article http://support.microsoft.com/kb/913668 for effecting Xml Serialization within the SQL CLR. That is, I have
1. Prebuilt the serialization assembly X.Serializers for the types in assembly X via the SGEN tool and,
2. Registered both assemblies with SQL Server via the create assembly directive
Yet, when I attempt to create an XmlSerializer on the basis of one of the types defined in X, SQL CLR ignores the pre-built serialization assembly and attempts to dynamically create/load the assembly. Since dynamic loading is disallowed, this fails with the expected exception:
System.InvalidOperationException: Cannot load dynamically generated serialization assembly. In some hosting environments assembly load functionality is restricted, consider using pre-generated serializer. Please see inner exception for more information. ---> System.IO.FileLoadException: LoadFrom(), LoadFile(), Load(byte[]) and LoadModule() have been disabled by the host.
Did this as a exercise and am fed up with my fruitless searching.Went and create an CLR assembly and all with min hassel. Now that Ihave that dll out there, I am tring to find some system table or somedisplay in management studio that shows me where the file is located onthe hard drive and cannot locate it.Can someone please point me in the correct location.Thanks.
I am trying to load multiple strongly named assemblies into the same database which are signed with the same .snk file (signed in Visual Studio). I use the following code to create an asymmetric key and login as Books Online recommends:
CREATE ASYMMETRIC KEY SQLCLRKey FROM FILE = 'D:dbainAssembly.dll'
CREATE LOGIN CLRAssembler FROM ASYMMETRIC KEY SQLCLRKey
GRANT UNSAFE ASSEMBLY TO CLRAssembler
GRANT EXTERNAL ACCESS ASSEMBLY TO CLRAssembler
REVOKE CONNECT SQL FROM CLRAssembler
Do I need to create a new login and asymmetric key for each assembly I load? If so, do I need to sign each with a different key because its giving me an error message when I try to create 2 separate asymmetric keys/logins from 2 different assemblies which have been signed with the same .snk file.
The only way I've gotten everything to load properly is to create a separate key for each assembly and sign each, then create separate logins and asymmetric keys in the database.
Is this the only way to do this? Or am I missing something?