Licensing for WinForms Control Hosted in Browser, Referenced Assem

[Guest]

Hello. I have this situation, and I don't know where to find an answer for
the issue; it's pretty advanced, but I hope somebody else already went
through this pain, and found the correct solution and help me out, as I'm
spending hours and hours on it without any result but frustration:

In a very simple ASP .NET page, Default.aspx, we will host a WinForms
control, let's call it WrapperControl. The WinForms control is defined in a
custom Windows control library assembly, let's call it WrapperAssembly.

The WrapperControl inherits from a BaseControl class, defined in a
referenced assembly, named BaseAssembly (in the WrapperAssembly there is a
reference to BaseAssembly).

The BaseControl (from BaseAssembly) is the one which needs licensing. I have
the .LIC file for BaseAssembly, installed in the folder that contains the
referenced DLL.

In WrapperAssembly.dll we embed the license for BaseAssembly as we have a
correct License.licx file (and can do it even by hand, using LC.exe,
generating .licenses file, which can later be added to WrapperAssembly.dll at
building time using /resource parameter for compiler).

If WrapperAssembly.dll would be WrapperAssembly.exe, and we would run it,
loading he control on screen, it would run correctly, without any issues, of
course.

But as we host WrapperControl from WrapperAssembly.dll on Internet Explorer,
this means that the "most outer" assembly would be... none (or Internet
Explorer.exe). And that would be the assembly which we should embed our
license file on.

I found this article - http://windowsclient.net/articles//licensing.aspx -
and a few others (similar) describing how to use the LC.exe-compiled
..licenses file in a web page, using the LINK REL="licenses" approach (in
HEAD).

I tried that in multiple ways already but however, no matter what, there is
no way I can get the BaseControl stop complaining that it's not licensed when
WrapperControl is loaded in the IE page.

If someone knows what could be wrong here - I'd appreciate if he or she
could help. Thanks in advance.

 

[Linda Liu [MSFT]]

Hi Sorin,

This is a quick note to let you know that I am performing research on this
issue and will get back to you ASAP.

I appreciate your patience!

Sincerely,
Linda Liu
Microsoft Online Community Support

==================================================
Get notification to my posts through email? Please refer to
http://msdn.microsoft.com/subscriptions/managednewsgroups/default.aspx#notif
ications.

Note: The MSDN Managed Newsgroup support offering is for non-urgent issues
where an initial response from the community or a Microsoft Support
Engineer within 1 business day is acceptable. Please note that each follow
up response may take approximately 2 business days as the support
professional working with you may need further investigation to reach the
most efficient resolution. The offering is not appropriate for situations
that require urgent, real-time or phone-based interactions or complex
project analysis and dump analysis issues. Issues of this nature are best
handled working with a dedicated Microsoft Support Engineer by contacting
Microsoft Customer Support Services (CSS) at
http://msdn.microsoft.com/subscriptions/support/default.aspx.
==================================================

This posting is provided "AS IS" with no warranties, and confers no rights.

 

[Linda Liu [MSFT]]

Hi Sorin,

I perform several tests based on the steps the
article(http://windowsclient.net/articles//licensing.aspx ) introduces and
succeed in browsing an html page that hosts a WinForm UserControl in it.

Could you tell me what version of the IIS on your web server? If you're
using IIS7, you should change the MIME Types to make .licenses allowed in
the IIS7.

To do this:
1. Open IIS Manager and select the 'Default Web Site' on the 'Connections'
panel.
2. Double click the 'MIME Types' under the 'HTTP Features' groups on the
middle panel.
3. Click the 'Add...' link on the 'Actions' panel.
4. In the 'Add MIME Type' window, type '.licenses' in the 'File Name
Extension' textbox and 'application/octet-stream' in the 'MIME Type'
textbox.

In addition, you have mentioned that you're using a simple ASP.NET page to
host the control. I suggest that you use an html page instead of an ASP.NET
page to see if the problem still exists.

Please try my suggestion and let me know the result.

Sincerely,
Linda Liu
Microsoft Online Community Support

 

[Guest]

Hello again and thanks for all the tips.

Finally I managed to find out what the problems were:

1. The licensed control used a custom license provider, which was defined as
an internal class within its own assembly. For some reason, a
MethodAccessException occured in these conditions, when our control was
hosted on IE (in limited security context). We asked the original developers
of the base control to update the license provide and set it as a public
class, then we could go further.

2. Another problem was that the custom license provider was based on
LicFileLicenseProvider, which always tried to look for the DLL and search for
the license file in the same folder. Looking a little at the way
LicFileLicenseProvider was created, we understood that it uses some
reflection methods, such as property FullName or so, that generated in the
end other security exception, FileIOPermission not being granted.

To resolve these we worked closely to the base control developers and asked
them to support licensing through Web also, not only based on LIC files near
the DLL. But for this they needed to change the license provider (method
GetLicense) to either look for the LIC file and read it, or to load the LIC
file from a Web request.

However, this is not good also because the LIC file this way is exposed
publicly, on the Web (through a http call).

In other words, it seems that the .licenses file done with LC.exe wasn't
loaded in "IE assembly" and therefore the GetLicense method of the license
provider didn't found it using "GetSavedLicenseKey". And therefore it tried
to load it from the LIC file, which now we redirected it from the Web.

The real (otpimal) solution would be to make .licenses file (compiled with
LC.exe) to actually be loaded by IE when accessing the page, and to keep the
license keys in memory, so that GetLicense method from the custom
LicFileLicenseProvider would found it at runtime, without needing to look for
the LIC file again. For this we didn't find yet a solution.

 

[Guest]

PS: We are not using IIS7, but instead try to host our site on IIS6, on
Windows Server 2003 (a SBS box).

 

[Linda Liu [MSFT]]

Hi Sorin,

Thank you for your detailed feedback.

In my tests, the .licenses file is placed on the same folder where the html
page hosting the licensed control resides. When I browse the html page
using IE, the .licenses file is requested by the IE. I see this in the IIS
log file.

The path to the IIS log file is like 'c:\inetpub\logs\logfiles\w3svc1'.
Alternatively, you may use Fiddler to watch the requests and responses
between the IIS and IE when you browsing web pages on the web server.

After IE receives the requested .licenses file, it caches the .licenses
file for later usage.

I suggest that you open the IIS log file on your web server or use Fiddler
to see whether the .licenses file is requested by IE when you browse the
html page hosting the licensed control, and whether the .licenses file is
granted by the IIS.

Sincerely,
Linda Liu
Microsoft Online Community Support

 

[Guest]

I also think that either the IE (we tested with version 7.0) doesn't (for
some reason) download the .licenses file at all, or the
LicenseProvider.GetSavedLicenseKey() method cannot access the license because
of FileOPermission missing security exceptions (note that we didn't trust
more than the default permissions for the assemblies from the server on the
client, using the .NET Framewok Configuration tool).

However, I will do the test using an IIS logger like you suggested and tell
you the answer. However I may be able to do these tests only the next week
(after June 16). The issue is not very urgent so it got postponed for now.

Thank you again for all the detailed help. I hope somebody else could use it
also.

Another thing I want to mention here is that even if it would work with
..licenses file stored on the Web server (IIS) and downloaded by IE, this is
still a license stealing threat, because someone else, not only IE could
downloaded the compiled .licenses file and then apply it to an application
that uses the downloaded DLL, and therefore using the controls without
properly purchasing a license for it. Just in case someone wants to find a
solution for that, the idea would be to not store the .licenses file at all
on the Web server, but instead: use a separate DLL with a control that
derives from the licensed DLL, embed the license in the second DLL, use the
second DLL as the entry point for the HTML page; if you want this to work in
high security context, like Web, you might need to provide your own
LicenseProvider class that is able to "manually" search and read the license
key from your application domain's DLLs (.NET deserialization is excluded
because of security also).

Note that even so, the license key is not really safe, because the .licenses
file (or the .dll file that contains the license embedded) actually contain
the license key without any encrypting!

So another question I might have, can I somehow encrypt the .license file,
in general, to still have it usable, but to not contain the license key
unencrypted in it?

 

[Guest]

I think I just found the issue for not being able to load the licenses
before. I stayed in my lunch break to do more tests and I found it, it's so
simple!

When I used LC.exe to generate the .licenses file I only passed
/i:BaseControl.dll because the BaseControl.dll was the assembly having the
license. I didn't also include /ierivedControl.dll which is the DLL
actually hosting the BaseControl in a wrapper DerivedControl class. If I
passed both assemblies using two /i: parameters at LC.exe, and used that
generated .licenses file, it worked successfully.

I appologize for not saying this before (that I din't pass both /i:
parameters), but I just dint't think at all about it!... Sorry for all the
time you spent on my issue. Anyway this I hope to be useful for some other
developers having the same issue.

 

[Linda Liu [MSFT]]

Hi Sorin,

Thank you for your detailed feedback.

I thought you passed /i:BaseControl.dll as well as /ierivedControl.dll in
the LC.exe command line. I did this in my tests. I should have shown you my
LC.exe command line for clarification. Sorry for this!

As for your another question of encrypting the .licenses file, I think you
could encrypt the content in the .LIC file first and then use the LC.exe to
create a .licences file based on the .LIC file.

Then you could implement a custom license provider to search the .licenses
file and decrypting the content in the .licenses file.

I suggest that you use the RSACryptoServiceProvider class to perform
asymmetric encrption and decryption using the implementation of the RSA
algorithm.

You may refer to the following MSDN document for examples on how to use the
RSACryptoServiceProvider class.

http://msdn2.microsoft.com/en-us/library/system.security.cryptography.rsacry
ptoserviceprovider.aspx

Hope this helps.

Sincerely,
Linda Liu
Microsoft Online Community Support

 

[Guest]

Thank you for all the information, including regarding using RSA and
encryption.