LiveDocs Comments - coldfusion - 7 - htmldocs - 00000301.htm

coldfusion/7/htmldocs/00000301.htm

Rob_in_KC — 2008-02-11T07:45:10

If you are not using the listGroups attribute, leave it at its default which is "no". The user will not authenticate if the number of characters returned by listGroups is > 469.

coldfusion/7/htmldocs/00000301.htm

ajpowellatl — 2005-07-07T07:16:01

Authentication via Active Directory can be achieved with CFLDAP and is quite effective.

Integrating CFLDAP with AD: http://www.macromedia.com/devnet/server_archive/articles/integrating_cf_apps_w_ms_active_directory.html

This tag will not work with Samba. I have tried using it to authenticate to a server running Mac OS X 10.3 and Samba 3.0. It fails every time with a user not in directory failure. I believe this is more tied to AD than the actual NT login.

coldfusion/7/htmldocs/00000301.htm

halL — 2005-02-10T14:00:45

I believe the following is true, but have not tested it, so I'm not marking it as an answer:

If the Web server uses Active Directory authentication to log a user in, it does not mean that the user is automatically logged into the ColdFusion application security framework.
If you have a cflogin tag, it will still execute.
When the cflogin tag executes, however, it automatically gets a cflogin structure with user's login ID from the web server authentication.

You must still use the cfloginuser tag to log the user into the ColdFusion security framework, and you specify the roles at that time.
The only way to specify roles to the ColdFusion security framework is in the cfloginuser tag.

For an example of using a web server based login with the ColdFusion security framework, see the "Web server-based authentication user security example" section in the Securing Applications chapter of the ColdFusion MX Developer's Guide, at http://livedocs.macromedia.com/coldfusion/7/htmldocs/00001187.htm.
The example starts about 2/3 of the way down on the page.
For more information on ColdFusion MX 7 security, see the rest of the chapter starting at http://livedocs.macromedia.com/coldfusion/7/htmldocs/00001175.htm.

If you need to get information, such as group or role related information, from the Active Directory, you must use the cfldap tag to query the directory.

coldfusion/7/htmldocs/00000301.htm

skibama1 — 2005-02-10T04:44:40

I wonder if a problem will arise if the user is auto-logged in by IE based on Active Directory crednetials. For example, your web page directory is secured based on AD groups and all your machines are set to auto login by IE based on local intranet security settings. I think this results in the login being recognized by CF before any authentication tags or functions can be run. I guess if I had a specific question with this tag it would be once a user is logged in, based on CF authentication or otherwise, how do you add roles to the roles list?

coldfusion/7/htmldocs/00000301.htm

jrunrandy — 2005-02-08T06:53:01

remecTim, you are correct and we have entered this as doc bug 59801.

Also, The cfNTauthenticate example is missing number signs around the roles attribute value for the cfloginuser tag. The correct line is as follows:

This is doc bug 59561.

coldfusion/7/htmldocs/00000301.htm

remecTim — 2005-02-07T16:58:27

The attribute "name" is incorrect, and will cause an error. That attribute is actually "username". The sample code has the correct usage.