.NET One Hop Rule and SharePoint Webparts

Question

Hi I have a SharePoint webpart which is compiled as a DLL and placed in the BIN folder of my SP site. My webpart works on my local machine, but when I put it on production it fails with a

(401) Unauthorized.

After doing some research I came acrooss what is known as the "One hop rule". Meaning I have to either pass in the credentials of a network user, or use

<identity impersonate= "true" />

in my web.config. I do not want to hard-code a network user, so my question is how can I use the impersonate in my web part? Do dll support web.configs? Thanks for the help.

Answer 1

I don't think there is away to add that in a DLL. To my knowledge anyways.

Answer 2

Your webpart fails in production probably because of CAS; You may need to elevate the permission level or append special accesses to be granted on your assembly, because it's not fully trusted as it is in the bin folder.

If you're sure it's just an impersonation problem, can you not just use nodes in your web.config?

Answer 3

Impersonate is always set to true in the web.config of a SharePoint application so the problem must be somewhere else. Web Parts that are deployed to the BIN folder of the Web Application run in a sandbox and, by default, have limited permissions. Perhaps that is the source of the problem.

Answer 4

Yes, as Tudor mentioned, it is likely Code Access Security. If you put it in the GAC you would not have this problem (the GAC is fully trusted).

Here are a few articles that should help you with CAS and SharePoint web parts. The trick is knowing which IPermissions you need.

• http://msdn.microsoft.com/en-us/library/ms916855.aspx
• http://www.combined-knowledge.com/Downloads/Code%20Access%20Security%20in%20SharePoint%202007%20for%20Administrators.pdf
• http://www.dotnetmafia.com/blogs/dotnettipoftheday/archive/2007/07/05/how-to-configure-code-access-security-for-a-web-part.aspx

Answer 5

If you're looking at the "double-hop" issue, then you won't use NTLM. You need to use Kerberos authentication because the Kerberos ticket can hop from user to webserver to web service. You'll need to setup Service Principle Names with SetSPN.

Is this web part calling out to external web services? Or is the permissions error based on local security?