SSRS checks if a user in a group is using a custom assembly

Question

I created a custom assembly for my SSRS project.

The custom assembly has 2 functions, IsInGroup and MyTest :

 using System; using System.Collections.Generic; using System.Text; using System.Security.Principal; namespace SSRS_Custom_Fuctions { public class Class1 { public static bool IsInGroup(string user, string group) { using (var identity = new WindowsIdentity(user)) { var principal = new WindowsPrincipal(identity); return principal.IsInRole(group); } } public static string MyTest() { return "Hello World"; } } } 

1) The main function MyTest , which returns the string "Hello World", works fine in the report using the expression =SSRS_Custom_Functions.Class1.MyTest()

2) The IsInGroup function, which returns a boolean, does not work. This uses the System.Security.Principal to check if the username passed to the function exists in the group passed to the function. When you try to call it using the expression =SSRS_Custom_Functions.Class1.IsInGroup(User.User1, "MyGroupName") report gives the following error message:

permission request type System.Security failed

I changed the rssrvpolicy.config configuration rssrvpolicy.config in the path of the ReportingServices file and RSPreviewPolicy.config in the path of the VisualStudio file in accordance with Microsoft KB920769 .

I added CodeGroup , which gives FullTrust my custom build.

The following has been added to the policy level element:

 <CodeGroup class="UnionCodeGroup" version="1" PermissionSetName="FullTrust" Name="SSRS_Custom_Fuctions" Description="Code group for my data processing extension"> <IMembershipCondition class="UrlMembershipCondition" version="1" Url="C:\Program Files\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\SSRS_Custom_Fuctions.dll"/> </CodeGroup> 

I am still getting the same error message as above.

Answer 1

In your assembly, you must first validate the SecurityPermission object before using it.

 using System; using System.Collections.Generic; using System.Text; using System.Security.Principal; namespace SSRS_Custom_Fuctions { public class Class1 { public static bool IsInGroup(string user, string group) { System.Security.Permissions.SecurityPermission sp = new System.Security.Permissions.SecurityPermission(System.Security.Permissions.PermissionState.Unrestricted); sp.Assert(); using (var identity = new WindowsIdentity(user)) { var principal = new WindowsPrincipal(identity); return principal.IsInRole(group); } } public static string MyTest() { return "Hello World"; } } } 

Answer 2

In the AssemblyInfo file you need to add namespace System.Security and

 [assembly: AllowPartiallyTrustedCallers()] . 

Sign the assembly with the certificate and deploy it to the GAC of the machine.