Professional ASP.NET 3.5 Security, Membership, and Role Management with C# and VB

5.8. Using Configuration in Partial Trust

The configuration examples you have seen so far all depended implicitly on one additional security setting in order to work: the trust level for the sample application. The sample applications have all been running in Full trust when calling into the configuration system. If you attempt to use the strongly typed configuration API, you can only do so by default when running in either Full or High trust. At lower trust levels, the strongly typed configuration API will fail.

For example, say you attempt to read the Membership configuration with code like the following:

C#

MembershipSection ms =
     (MembershipSection)ConfigurationManager.GetSection("system.web/membership");

VB.NET

Dim ms As MembershipSection = _
  CType(config.GetSection("system.web/membership"), _
  MembershipSection)

If your application is running in Medium trust or below, you get an exception with the following information:

Request for the permission of type 'System.Security.Permissions.FileIOPermission,
mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed. (machine.config)
Stack Trace:
...
   at System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint,
Boolean includeStagesAfterAsyncPoint)

Chapter 4 explained that when you encounter permission-related exceptions, the exception information and stack trace can sometimes give you a clue as to what happened. In this case, it looks like the configuration system made a check for a permission, ...