Manifested Controls Redux

Last year, I made a series of posts about a new feature available in the betas of .NET 3.5 which enabled you to specify declaratively the set of permissions that IE hosted managed controls should run with.  Since the betas there have been a couple of tweaks to the manifest control model, so those posts need a refresh.

Most notably, the Low Safety (Unrestricted) setting for the Permissions for Components with Manifests URL action is not a part of the final shipping Orcas bits.  Instead, the two options are:

  • High Safety - manifested controls can run with the permissions it requests, but only if those permissions are a subset of the permissions it would have been granted by CAS policy or if the manifests are signed by a trusted publisher.

  • Disabled - manifested controls may not run at all.

If you're using a machine that had one of the .NET 3.5 betas on it, the Low Safety option will still appear in your Internet Explorer dialog box, however the CLR will treat a value of Low Safety as if it were Disabled.

A lot of times when people look at this feature, they would like a full end-to-end sample of a control in a web page taking advantage of a manifest to elevate its permissions.  I've attached a ZIP file containing a sample control to this post.

In order to use this sample:

  1. Create a ManifestControl subdirectory in your wwwroot.
  2. Copy ManifestControl.control, ManifestControl.dll, ManifestControl.dll.manifest, and ManifestControl.html to the ManifestControl directory created in step 1.
  3. Ensure that your web server is setup to allow downloading of .dll, .control, and .dll.manifest files.
  4. Install ManifestControl.cer in your Trusted Publishers certificate store.
  5. Install ManifestControl.cer in your Trusted Root Certification Authorities certificate store. (Once you are done with the sample, the test certificate should be removed from both of these certificate stores)
  6. Navigate Internet Explorer to http://localhost/ManifestControl/ManifestControl.html

Comments (1)

  1. Pavel says:

    It did not quite work for me. Here are some corrections to make this work:

    1. It is not ManifestControl.cer that has to be in Trusted Publishers certificate store. It is ManifestControl.cer’s signing Certificate Authority that has to be there.

    Open .cer file, find the Certificate Authority certificate on the last tab (CA’s name is Root Agency), copy it to a file and then install to Trusted Publishers.

    2. If you want to re-sign, it’s not enough to call Mage.exe with /Sign parameter as stated in ManifestControl.html. After you update .manifest file its hash changes and you need to update it in .control file. Whole batch file will be

    mage.exe -Sign ManifestControl.dll.manifest -CertFile ManifestControl.pfx -Password password

    mage.exe -Update ManifestControl.control -AppManifest ManifestControl.dll.manifest -CertFile ManifestControl.pfx -Password password

    mage.exe -Sign ManifestControl.control -CertFile ManifestControl.pfx -Password password

    I hope it helps someone.

Skip to main content