I have a clickonce app with embedded VB "custom code" for a local rdlc report file. When I deploy this to a file share and then install on a client - I have file IO permission (I can write a text file on the client).

However, when I try to run a report - I get the following exception:

Microsoft.Reporting.WinForms.LocalProcessingException: An error occurred during local report processing. ---> Microsoft.Reporting.DefinitionInvalidException: The definition of the report 'Main Report' is invalid. ---> Microsoft.ReportingServices.ReportProcessing.ReportProcessingException: An unexpected error occurred in Report Processing. ---> System.Security.SecurityException: Request for the permission of type 'System.Security.Permissions.FileIOPermission, mscorlib, Version=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089' failed.

I'm using ExecuteReportInCurrentAppDomain in my code.

As I mentioned, I can write to the client. Also, If I publish to my local drive and then install, I don't get any errors when running a report. It seems like there's some security that I'm not granting to the report, specifically FileIO. Can someone shed some light on this?

Yes.

In the .Net framework configuration, under My Computer>Runtime Security Policy>Machine>Code Groups>Runtime Security Policy>Code Groups>All Code>LocalIntranet Zone, under the Permissions tab - the security policy for that zone is not set to "Full Trust" by default. In order for an app to be deployed over the local intranet - the client machine's policy must be set to "Full Trust", or you will run into runtime issues (depending on what your app does).

This requires that each client's security policyis modified before or after your application is installed on the client. The Microsoft 2003 Server SDK contains a tool called ORCA that you can use to create an .msi file. Include this file with your application and it will automatically run when your application setup installs the app on the client machine.ORCA is a fairly extensive tool, and I haven't even scratched the surface of it. According to Microsoft, it's the full-blown deployment tool of choice - even better than creating a deployment project for your app.

Hope this helps! I spent a few hours on the phone with MS to finally get a solution.

Got exactly same issue.

Anyone knows what can help ?

Yes.

In the .Net framework configuration, under My Computer>Runtime Security Policy>Machine>Code Groups>Runtime Security Policy>Code Groups>All Code>LocalIntranet Zone, under the Permissions tab - the security policy for that zone is not set to "Full Trust" by default. In order for an app to be deployed over the local intranet - the client machine's policy must be set to "Full Trust", or you will run into runtime issues (depending on what your app does).

This requires that each client's security policyis modified before or after your application is installed on the client. The Microsoft 2003 Server SDK contains a tool called ORCA that you can use to create an .msi file. Include this file with your application and it will automatically run when your application setup installs the app on the client machine.ORCA is a fairly extensive tool, and I haven't even scratched the surface of it. According to Microsoft, it's the full-blown deployment tool of choice - even better than creating a deployment project for your app.

Hope this helps! I spent a few hours on the phone with MS to finally get a solution.

Thanks for the post.

I used caspol.exe via a custom side app to add my website to.NET Framework Configuration'sRuntime Security Policy>Machine>Code Groups>All Code anddemand my users to consider this custom app as a prerequisite.

The Reports are now allowed to FileIO.

Using ORCA the way you suggested wouldn't help, because I don't want my main app to require administrative privileges when installing.

But I think this is not an acceptable solution. I can't believe MS didn't manage a better solution to use ReportViewer via ClickOnce.

Any other idea or suggestion is welcome...

I didn't investigate to see if using ORCA grants actual administrative permissions to the app. However, I'm on a corporate intranet behind a firewall - so I don't have to be that concerned about the app being able to write or do whatever it needs to on a corporate client. My biggest concern at the time was deployment, and not having to perform some sort of preconfiguration on each client before or after install. I thought that the worst part about it is - the reports are readonly, there's no writing going on. The reason they weren't running was because of insufficient priviledges to use resources on the client.

I do agree with you concerning how security for ClickOnce reporting is handled, you would think that there would be a better way to manage it. Microsoft didn't offer me any solutions other than manually adjusting security or using ORCA.

Hopefully, there are some improvements in the 3.0 framework, but I'm not holding my breath.