Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB

15.2. Provider Security

There are two levels of security enforced by SqlRoleProvider: trust-level checks and database-level security requirements. You influence the trust-level check by setting the appropriate trust level for your web application and optionally making other adjustments to the CAS policy on your machine. Database-level security requirements are managed through the use of SQL Server roles.

15.2.1. Trust-Level Requirements and Configuration

Inside of the provider's Initialize method, a check is made for Low trust. If the current application is running at Low trust or higher, then the provider will initialize itself. Otherwise, if the application is running in Minimal trust, the initialization process will fail. Outside of ASP.NET, local applications like console applications or Windows Forms application implicitly run in Full trust, so the trust level check in the Initialize method always succeeds.

For an ASP.NET application running in Low trust, the provider may still fail when you attempt to call any of its methods because the default Low trust policy file does not include SqlClientPermission. In this case, the Initialize method completes successfully because the Low trust-level check succeeds. But then when an individual method attempts to access SQL Server, the System.Data.SqlClient classes throw a security exception because the web application does not have SqlClientPermission. If you want to enable the provider for use in Low trust, you should do two things: ...