What is the minimum CLR permission sets needed for Pega to run UDFs?
Hi,
Pega needed the CLR to be enabled to run UDFs.
As I understand, there are 3 permission sets for CLR: SAFE, EXTERNAL_ACCESS and UNSAFE:
Can Pega run with just the SAFE mode?
Thanks and regards,
Jacky
Accepted Solution
Pegasystems Inc.
US
Pegasystems Inc.
IN
Hi,
Although there is no such mentioned document were the mode will be a factor for CLR to be enabled.
As far as Pega is concerned the CLR should be enabled for using UDFs. And as I checked with one SME they told the same. Let us know if you find any restriction regarding this.
https://docs-previous.pega.com/pega-72-platform-installation-guide-weblogic-and-mssql
Thank You.
Pegasystems Inc.
SG
Hi,
Maybe I should rephrase it, CLR is only enabled/disabled. What I am referring to is the "SQL Server Host Policy Level Permission Sets":
"SQL Server supplies a host-level security policy level to the CLR while hosting it; this policy is an additional policy level below the two policy levels that are always in effect. This policy is set for every application domain that is created by SQL Server. This policy is not meant for the default application domain that would be in effect when SQL Server creates an instance of the CLR."
This has 3 settings as follows:
SAFE
Only internal computation and local data access are allowed. SAFE is the most restrictive permission set. Code executed by an assembly with SAFE permissions cannot access external system resources such as files, the network, environment variables, or the registry.
EXTERNAL_ACCESS
EXTERNAL_ACCESS assemblies have the same permissions as SAFE assemblies, with the additional ability to access external system resources such as files, networks, environmental variables, and the registry.
UNSAFE
UNSAFE allows assemblies unrestricted access to resources, both within and outside SQL Server. Code executing from within an UNSAFE assembly can also call unmanaged code.
Hi,
Maybe I should rephrase it, CLR is only enabled/disabled. What I am referring to is the "SQL Server Host Policy Level Permission Sets":
"SQL Server supplies a host-level security policy level to the CLR while hosting it; this policy is an additional policy level below the two policy levels that are always in effect. This policy is set for every application domain that is created by SQL Server. This policy is not meant for the default application domain that would be in effect when SQL Server creates an instance of the CLR."
This has 3 settings as follows:
SAFE
Only internal computation and local data access are allowed. SAFE is the most restrictive permission set. Code executed by an assembly with SAFE permissions cannot access external system resources such as files, the network, environment variables, or the registry.
EXTERNAL_ACCESS
EXTERNAL_ACCESS assemblies have the same permissions as SAFE assemblies, with the additional ability to access external system resources such as files, networks, environmental variables, and the registry.
UNSAFE
UNSAFE allows assemblies unrestricted access to resources, both within and outside SQL Server. Code executing from within an UNSAFE assembly can also call unmanaged code.
As far as I understand, since the Pega UDFs are used to read and retrieve property values directly from Binary Large Objects (BLOBs) in the database, there is really no need for it to have EXTERNAL_ACCESS or UNSAFE permission set.
However, can support confirm this that the SAFE permission set is enough for Pega to run properly?
Thanks and regards,
Jacky
Accepted Solution
Pegasystems Inc.
US
Hi Jacky,
I agree that there seems no reason for other than safe access. I took a look on my Pega 7.2.2 system using this SQL and it is indeed a SAFE assembly.
select name, permission_set, permission_set_desc from sys.assemblies where name = 'prreadstream';
name permission_set permission_set_desc
prreadstream 1 SAFE_ACCESS
-------------------------------------------------------------------------------
below are other queries, etc. around these in MS/SQL that are interesting - your schema may vary
select name,permission_set,permission_set_desc from sys.assemblies where name = 'prreadstream';
go
select * from sys.assembly_files where name = 'prreadstream';
go
select * from sys.assembly_modules where assembly_class like '%directstreamreader%';
go
select * from INFORMATION_SCHEMA.ROUTINES where ROUTINE_TYPE = 'FUNCTION';
go
sp_configure 'clr enabled', 1;
go
Reconfigure
go
select DATA.pr_read_from_stream('pxInsName', pzInsKey, pzPVStream) from DATA.pr_data
go
Pegasystems Inc.
SG
Hi,
Thanks for the confirmation, this is exactly what I needed.
Regards,
Jacky
Hi Jacky,
I agree that there seems no reason for other than safe access. I took a look on my Pega 7.2.2 system using this SQL and it is indeed a SAFE assembly.
select name, permission_set, permission_set_desc from sys.assemblies where name = 'prreadstream';
name permission_set permission_set_desc
prreadstream 1 SAFE_ACCESS
-------------------------------------------------------------------------------
below are other queries, etc. around these in MS/SQL that are interesting - your schema may vary
select name,permission_set,permission_set_desc from sys.assemblies where name = 'prreadstream';
go
select * from sys.assembly_files where name = 'prreadstream';
go
select * from sys.assembly_modules where assembly_class like '%directstreamreader%';
go
select * from INFORMATION_SCHEMA.ROUTINES where ROUTINE_TYPE = 'FUNCTION';
go
sp_configure 'clr enabled', 1;
go
Reconfigure
go
select DATA.pr_read_from_stream('pxInsName', pzInsKey, pzPVStream) from DATA.pr_data
go