Basic sharing on Code Access Security (CAS)

Controlling access to system resources ( Dir structures and file) 

WSS have 2 security approaches :

• user identity-based
• code identity-based [digital certificate or URL or site]

WSS is use .NET Framework , which is using code identity-based approach so call CAS


Levels of trust

• Full > unmanaged code
• High > cannot call unmanaged code and enterprise service but can send email using SMTP servers , also can access sockets and file system
• Medium >  SMTP and SQL but cannot access sockets and registry
• Low > read only application virtual dir and no network connectivity
• Minimal > have execute permission only

WSS have 2 policy ( Virtual server extedned to wss this policy will applied to)

• wss_minimaltrust.config
• wss_mediumtrust.config

WSS security setting for CAS:

• machine.config > c:\windows\micorsoft.net\framwork\V2.0.50727\config
• web.config

Web.config located

• top level conetn root > C:\Inetpub\wwwroot > configuration for web server
• web part resoucces of the global assemy cache
• CONFIG ….\web server extensions\60\config\ > define for other extending vs
• ISAPI ….for the /_vti_bin
• LAYOUTS > for /_layouts
• ADMIN > SharePoint CA