LiveDocs Comments - coldfusion - 6 - Developing_ColdFusion_MX_Applications_with_CFML - appSecurity5.htm

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

2004-07-09T12:04:00

I had to do this to make the idleTimeout work properly...

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

Doug Cain — 2003-12-08T19:24:44

I noticed my application wasn't logging out after the idletimeout which I thought was weird as I based my code on the MM cflogin example. Found this in the forums which solves it and explains the problem:

http://webforums.macromedia.com/coldfusion/messageview.cfm?catid=12&threadid=647844&highlight_key=y&keyword1=cflogin

Seems like the breaks the idletimeout state for some reason (bug?)

Anyway thought this would be helpful for anyone who is looking at cflogin.

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

Slam — 2003-05-10T08:13:00

wow i looked all over the place wondering what i was doing wrong with my app and here i find out its IIS ... bah .. im glad i finally found the info .. but you should SAY THAT ....

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

carehart@systemanage — 2002-12-05T04:09:00

Tom, that fix does not solve the problem I raised, which is that the example of find statuscode 401 authentication (code above on this page) simply fails to work if IIS integration is implemented. It works find on the built-in web server.

I don't know if you were referring to that problem in your note above, but changing the authentication settings for the directory in IIS made no difference to the code. My testing has shown that CF is simply not setting the CFLOGIN scope if the user is coming in through IIS.

This is on both the base version and the updater 1.

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

tommuck — 2002-11-30T22:29:00

The problem is in the default IIS settings. To get the cflogin tags to work properly -- allowing the setCredentials() method to work in Flash Remoting -- you need to open up IIS admin interface and right-click on your Web application and choose Properties > Directory Security > Anonymous Access > Edit. Here you will have to uncheck the Integrated Windows Authentication. Using integrated authentication only allows users that are set up under Windows to access pages in a directory protected by a cflogin system. The system works perfectly with the built-in CFMX web server. Screenshot of the admin interface of IIS at http://www.flash-remoting.com/notablog/images/iis_auth.jpg

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

carehart@systemanage — 2002-11-29T23:11:00

More on that statuscode 401 approach to authentication, I found something interesting in Chapter 11 that may be useful for readers to note. (It's not related at all to the issue I just brought up about it failing on IIS.)

Chapter 11 has this statement about how the "realm" feature of this approach can be used which ought to be present on this page as well:

"The security realm name can be used to bind multiple directories together. If Application.cfm files located in those directories use the same realm name, only a single login is required to access resources in those directories. However, each Application.cfm file can establish different roles for a user. "

If it does indeed work, that's cool to know (and a potential explanation for when people find that use of the approach in one directory causes users to login without an authentication prompt in another directory.)

/charlie

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

carehart@systemanage — 2002-11-29T23:06:00

Regarding the feature described in the section "Using application-based security with a browser's login dialog", of using using the status code 401 access denied approach to authentication, I (and others) have found that it fails with web server integration using IIS. It does work against the built-in web server. I've found no other references to this in the forums, the knowledge base, nor these livedocs comments.

When run under IIS, you can never authenticate (using the sample admin/p1 combination for username/password that's offered in the code example).

This is really annoying, if for no other reason that the docs don't say it shouldn't work. Has anyone else experienced or explored this?

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

jochemd — 2002-10-21T20:31:00

If you have a problem with CF MX caching login information upon logout, try moving the cflogout tag below the cflogin tag.

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

carehart@systemanage — 2002-09-14T20:38:00

This page's "Application-based user security example" must be changed to clarify that the "cflogin" scope will exist **only** if the form being used for the login uses j_username and j_password for the input fields.

If the user doesn't notice this and just uses "username" and "password" on their own (rather than cutting and pasting the form offered in the code later in the page), they'll find that the code doesn't work at all--because the first test for isdefined("cflogin") is never true.

This isn't at all obvious.

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

rnielsen — 2002-09-10T20:09:00

URL is a reserved word. I have entered this as doc bug number 47944.

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

sgilson102 — 2002-06-24T17:20:00

Here is how I solved that error...

Please Log In

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

cfmxdave — 2002-05-13T13:32:00

In the following code (used in a couple of places)

there is a double quote missing from the front of MyApp/index.cfm"

coldfusion/6/Developing_ColdFusion_MX_Applications_with_CFML/appSecurity5.htm

cfmxdave — 2002-05-13T13:14:00

In the section ?Application-based user security example? there is a code example for loginform.cfm.
The first line creates a variable called url that is used as the action page for the form. I found that this throws an error when the page gets to the form declaration. The error says something about this being a complex variable when it should be a simple variable. I was able to remedy the situation by changing the variable name ?url? to ?newurl? (or anything else for that matter) in all instances.