IIS7 Failed to grant minimum permission requests

Question

I get this error when I'm using FileHelpers.dll, but my IIS is set to Full trust level so it should not be that way

That's the full stack trace:

    [PolicyException: Required permissions cannot be acquired.]
       System.Security.SecurityManager.ResolvePolicy(Evidence evidence, PermissionSet reqdPset, PermissionSet optPset, PermissionSet denyPset, PermissionSet& denied, Boolean checkExecutionPermission) +10238142
       System.Security.SecurityManager.ResolvePolicy(Evidence evidence, PermissionSet reqdPset, PermissionSet optPset, PermissionSet denyPset, PermissionSet& denied, Int32& securitySpecialFlags, Boolean checkExecutionPermission) +97

    [FileLoadException: Could not load file or assembly 'FileHelpers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=3e0c08d59cc3d657' or one of its dependencies. Failed to grant minimum permission requests. (Exception from HRESULT: 0x80131417)]
       System.Reflection.Assembly._nLoad(AssemblyName fileName, String codeBase, Evidence assemblySecurity, Assembly locationHint, StackCrawlMark& stackMark, Boolean throwOnFileNotFound, Boolean forIntrospection) +0
       System.Reflection.Assembly.InternalLoad(AssemblyName assemblyRef, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) +416
       System.Reflection.Assembly.InternalLoad(String assemblyString, Evidence assemblySecurity, StackCrawlMark& stackMark, Boolean forIntrospection) +166
       System.Reflection.Assembly.Load(String assemblyString) +35
       System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +190

    [ConfigurationErrorsException: Could not load file or assembly 'FileHelpers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=3e0c08d59cc3d657' or one of its dependencies. Failed to grant minimum permission requests. (Exception from HRESULT: 0x80131417)]
       System.Web.Configuration.CompilationSection.LoadAssemblyHelper(String assemblyName, Boolean starDirective) +11207304
       System.Web.Configuration.CompilationSection.LoadAllAssembliesFromAppDomainBinDirectory() +388
       System.Web.Configuration.CompilationSection.LoadAssembly(AssemblyInfo ai) +232
       System.Web.Configuration.AssemblyInfo.get_AssemblyInternal() +48
       System.Web.Compilation.BuildManager.GetReferencedAssemblies(CompilationSection compConfig) +210
       System.Web.Compilation.BuildProvidersCompiler..ctor(VirtualPath configPath, Boolean supportLocalization, String outputAssemblyName) +76
       System.Web.Compilation.ApplicationBuildProvider.GetGlobalAsaxBuildResult(Boolean isPrecompiledApp) +283
       System.Web.Compilation.BuildManager.CompileGlobalAsax() +50
       System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled() +676

    [HttpException (0x80004005): Could not load file or assembly 'FileHelpers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=3e0c08d59cc3d657' or one of its dependencies. Failed to grant minimum permission requests. (Exception from HRESULT: 0x80131417)]
       System.Web.Compilation.BuildManager.ReportTopLevelCompilationException() +76
       System.Web.Compilation.BuildManager.EnsureTopLevelFilesCompiled() +1012
       System.Web.Hosting.HostingEnvironment.Initialize(ApplicationManager appManager, IApplicationHost appHost, IConfigMapPathFactory configMapPathFactory, HostingEnvironmentParameters hostingParameters) +1025

[HttpException (0x80004005): Could not load file or assembly 'FileHelpers, Version=2.0.0.0, Culture=neutral, PublicKeyToken=3e0c08d59cc3d657' or one of its dependencies. Failed to grant minimum permission requests. (Exception from HRESULT: 0x80131417)]
   System.Web.HttpRuntime.FirstRequestInit(HttpContext context) +11301302
   System.Web.HttpRuntime.EnsureFirstRequestInit(HttpContext context) +88
   System.Web.HttpRuntime.ProcessRequestNotificationPrivate(IIS7WorkerRequest wr, HttpContext context) +4338644

Answer 1

I had a similar problem when I rebuilt my dev machine with a clean Windows 7 install. After hunting around I discovered a solution that worked for me.

In your IIS application pool advanced settings, under "Process Model", set Load User Profile to true.

There are some other things to check like your trust level, but none of them applied to me (it was all full trust already on my dev machine). Setting the application pool to load user profile fixed it.

Answer 2

I've seen this error in another instance where, for example, IIS is running an application or virtual path via a UNC path (i.e. \\svr\share\folder). Even if Load User Profile=true I still got the PolicyException error. It was solved by running the Code Access Security Policy Tool (Caspol.exe) to add full trust to the UNC path. Since we had both 64 bit and 32 bit of .Net 2.x and .Net 4.x, I ran it in all four environments as follows:

%SystemRoot%\Microsoft.NET\Framework\v2.0.50727\caspol.exe -pp off -m -ag 1 -url "file:////\\svr\share\folder\*"   FullTrust -exclusive on
%SystemRoot%\Microsoft.NET\Framework\v4.0.30319\caspol.exe -pp off -m -ag 1 -url "file:////\\svr\share\folder\*"   FullTrust -exclusive on
%SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\caspol.exe -pp off -m -ag 1 -url "file:////\\svr\share\folder\*"   FullTrust -exclusive on
%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\caspol.exe -pp off -m -ag 1 -url "file:////\\svr\share\folder\*"   FullTrust -exclusive on

Some notes of caution:

• For .Net 4.x be sure to enable the NetFx40_LegacySecurityPolicy to true or the caspol.exe commands won't work as expected.

• Do not add duplicate entries with caspol.exe for a given environment. Run the commands below to view your entries:

  %SystemRoot%\Microsoft.NET\Framework\v2.0.50727\caspol.exe -a -lg %SystemRoot%\Microsoft.NET\Framework64\v2.0.50727\caspol.exe -a -lg %SystemRoot%\Microsoft.NET\Framework\v4.0.30319\caspol.exe -a -lg %SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\caspol.exe -a -lg

Answer 3

This is a security/trust issue. Open the properties of the DLL in Windows Explorer. It's likely marked as blocked because it was downloaded it from the internet. Go to properties & click the "unblock" button and the problem may be solved.

Answer 4

We had a similar issue with Windows 2008 R2 where our application would work fine in 64bit mode but when switched to 32 bit mode would cease to function and throw the permission error, turns out, in IIS7 under Advanced Settings >> Process Model >> the "Identity" setting had been switched to "Application Pool Identity" by default and may need changed to "Network Service" to work in 32 bit mode.

We did that and now we are humming along smoothly. Figured this tidbit of info may be the reason that everyone points to folder permissions, because technically it is a folder permission issue. But the change was in IIS and not the security settings on the folders themselves.