Wpf – How to deploy a WPF 4 Full Trust XBAP an on intranet

So far, I've found 2 ways to do this. Through a really complicated method of installing certificates on the target machine.

Or through a simpler method, which is only suitable for intranets here:

Deploy a custom CLR Security policy that modifies the default permissionset for the given zone

So I did just that, and it works. Here's the detailed steps how I got it to work:

1. Open Control Panel > Administrative Tools > .NET Framework 2.0 Configuration
2. Expand Runtime Security Policy > Machine > Code Groups > All_Code
3. Right Click All_Code and click New…
4. Create a new code group, I named mine MyProject_FullTrust_Zone
5. Choose the URL condition type and specify the path on the network where the apps will be deployed.
6. Choose Use Existing permission set, and set it to Full Trust.

Now the only problem with this method, is that I have to deploy this change to hundreds of machines. So maybe there's still a simpler way to do this?

I have worked in a similar situation of using ClickOnce as the engine to deploy the binaries as XBAP as well as standard WPF. To install the XBAP website at a customer site, we would have an installer create the virtual directory in IIS and then run a custom step to sign the ClickOnce manifests. This step was necessary as the application needed to access a generated configuration file that contained information about the customer environment.

Here are some notes on issues that I've seen with using XBAP.

• Dependency of Framework v3.0 or higher on the Client's workstation. (More of a general note when dealing with WPF, as unless you are using a controlled desktop, you may have to deploy this as well)
• Inexplicably the user's ClickOnce cache would be invalidated, requiring the user to have to clear their cache using: rundll32 %windir%\system32\dfshim.dll CleanOnlineAppCache
• Bad installation of Framework v3.0/Internet Explorer requires the user's profile to be recreated, dotNet framework to be reinstalled, or Internet Explorer be reinstalled.
• Poor error messages from ClickOnce when deployments would fail. A lot of times it would report a general Deployment Exception, and the fix would be one of the above steps.
• When using any authentication in front of the website, such as ASP.Net forms auth, IIS trusted (not on intranet), or a proxy like ISA, there is an issue within the Microsoft stack where IE will not be able to pass authentication to the ClickOnce engine. The problem, is that IE will successfully authenticate, but will be unable to pass the security context to ClickOnce. When ClickOnce tries to deploy the application files, it will have no security context, and authentication will fail. But if you go to Internet Options --> Security--> select 'Local Intranet' --> Click 'Custom level...' You will see a list of Settings. Scroll to the bottom of the list and Under User Authentication --> Logon --> make sure that the option 'Automatic logon with current user name and password' is selected. This should allow IE to pass authentication info to the click once applications.