CLR fce in MS SQL 2012 DirectoryServicesPermission failed

Question

Hello,
I did this all and result isnt good :-)
When I try to call the function dbo.fn_jk_ver_email(@param) the error occurs:
// SQL settings
USE master
GO
CREATE ASYMMETRIC KEY DirectoryServices_Key
FROM EXECUTABLE FILE = 'C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll';
CREATE LOGIN DirectoryServices_Login
FROM ASYMMETRIC KEY DirectoryServices_Key;
GRANT EXTERNAL ACCESS ASSEMBLY TO DirectoryServices_Login;
GRANT UNSAFE ASSEMBLY TO DirectoryServices_Login;
GO
USE CRMMAFRA_TEST_23032014
GO
CREATE ASSEMBLY DirectoryServices FROM 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.dll' --na serveru
WITH PERMISSION_SET = UNSAFE;
GO
-- Create My_CLR_function in SQL
USE CRMMAFRA_TEST_23032014
GO
CREATE FUNCTION [dbo].[fn_jk_ver_email]( @adresa nvarchar(100))
RETURNS int
WITH EXECUTE AS CALLER
AS
EXTERNAL NAME LDAP_CLR.UserDefinedFunctions.jk_ver_email;
GO
//CLR fce deployed into SQL
using System;
using System.Data;
using System.DirectoryServices.AccountManagement;
using System.DirectoryServices;
using System.Data.SqlClient;
using System.Data.SqlTypes;
using Microsoft.SqlServer.Server;
public partial class UserDefinedFunctions
[Microsoft.SqlServer.Server.SqlFunction]
public static SqlInt32 jk_ver_email(string emailadresamoje)
int vysledek = 0;
int firstCharacter = emailadresamoje.IndexOf("@") + 1;
string domena = emailadresamoje.Substring(firstCharacter);
string ldapstr = "LDAP://" + domena;
emailadresamoje = emailadresamoje.ToLower();
using (DirectoryEntry entry = new DirectoryEntry(ldapstr))
DirectorySearcher dSearch = new DirectorySearcher(entry);
dSearch.Filter = "(objectClass=user)";
foreach (SearchResult sResultSet in dSearch.FindAll())
if (sResultSet.Properties["mail"].Count > 0)
//if (String.ReferenceEquals(sResultSet.Properties["mail"][0].ToString(), emailadresamoje))
bool result = Equals(sResultSet.Properties["mail"][0].ToString().ToLower(), emailadresamoje);
if (result)
vysledek = 1;
return new SqlInt32(vysledek);
Msg 6522, Level 16, State 2, Line 1
A .NET Framework error occurred during execution of user-defined routine or aggregate "fn_jk_ver_email":
System.Security.SecurityException: Request for the permission of type 'System.DirectoryServices.DirectoryServicesPermission, System.DirectoryServices, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a' failed.
System.Security.SecurityException:
   at UserDefinedFunctions.jk_ver_email(String emailadresamoje)

Answer 1

Hi
I've fixed this finally - at least for me!
It appears that if your assembly is using an assembly that has been marked as 'unsafe' - such as the DirectoryServices one - then your own assembly must be set to 'unsafe' as well. I changed a number of things in Visual Studio to this affect and then re-published
and the error went away and it all works fine now, AD from SQL server! However, I didn't use any of the manual scripted key generation code though that you used. The only T-SQL I used in this whole project was this...
ALTER DATABASE MyDatabase SET TRUSTWORTHY ON
GO
IF NOT EXISTS (SELECT * FROM sys.assemblies WHERE [name] = 'System.DirectoryServices.AccountManagement')
BEGIN
CREATE ASSEMBLY [System.DirectoryServices.AccountManagement]
FROM 'C:\Windows\Microsoft.NET\Framework64\v4.0.30319\System.DirectoryServices.AccountManagement.dll'
WITH PERMISSION_SET = UNSAFE
END
And these are the steps to what I changed in Visual Studio...
1) First right click on the project in the solution explorer to get the project settings tabs up...
2) Under the 'Project Settings' tab click on the 'Database Settings' button, when the dialog comes up goto the 'Miscellaneous' tab and tick the 'Trustworthy' option (even if you've set the database as trustworthy in SQL server using T-SQL still do this,
wouldn't work for me until I did this as well)
3) Next under the 'SQLCLR' tab set the assembly permission level to 'UNSAFE'
4) Lastly (not sure if this is required) still under the 'SQLCLR' tab click on the 'Signing' button and create a new strong name key file, call it anything and click ok and make sure that it's now showing as the selected strong name key file. Probably a
security risk but hey. Then don't forget to click ok!
5) Save everything and rebuild, then publish to your database and test again - hopefully it works!
Good luck
Padigan