Welcome!

You will be redirected in 30 seconds or close now.

ColdFusion Authors: Yakov Fain, Jeremy Geelan, Maureen O'Gara, Nancy Y. Nee, Tad Anderson

Related Topics: ColdFusion

ColdFusion: Article

Leveraging on Active Directory for ColdFusion Users

The majority of ColdFusion applications live far away, hidden, in enterprise fortresses

The majority of ColdFusion applications live far away, hidden, in enterprise fortresses as applications that small-to-large organizations depend on. In these organizations, especially the medium-to-large ones, there are well-established network infrastructures to manage the users, workstations, servers, etc.

Organizations usually implement LDAP as a directory services infrastructure but, for the purposes of this article, I will only be discussing Active Directory.

Active Directory, AD, is an LDAP implementation from Microsoft that was introduced with the Windows 2000 environment. This implementation is based on the X.500 LDAP standards. The AD is a giant database that can store as much as 16 terabytes or 1 billion objects ranging from users, printer locations, security policies, and, also important, user-defined data.

Every application that interacts with users usually has restrictions based on profiles and must also implement security. These are especially important for applications in financial organizations. Based on my experience, building user and profile management into applications, which is not a trivial matter, take considerable time and effort in the software development cycle. It doesn't stop with this; users don't like to have multiple security credentials across many applications. There is nothing more frustrating for these users than having to remember which username and password work with which application.

One of the beauties of Microsoft's Web-based/enabled applications is the ease at which they plug in to its existing network infrastructure. Outlook Web Access (OWA) users use their network security credentials to log in. Not only that, OWA knows when a user is logged into a computer, so it automatically loads the user's profile from the AD.

ColdFusion has support for LDAP, which includes AD. Using CFLAP, the ColdFusion tag for interacting with LDAP servers, you could leverage on AD for user management and profiling.

In the next few paragraphs, I'll show how you can use CFLAP to authenticate and load user profiles in AD for use in your application.

Step 1: Preparation
For the sake of this article, imagine you are writing an application for a financial institution called Bank X Inc. Bank X has implemented its AD as bankx.com. To write your application, you must know the name or IP of an AD server (Domain Controller, DC) that will authenticate your users. You must also know the structure of your AD. Please consult with your Domain Administrator for documentations.

Step 2: Login
The following is a simple login form to be used by Bank X users to log in to their financial applications:

<form action="loginADUser.cfm" method="post">
   <label for="username" accesskey="u">Username:</label>
   <input name="username" type="text" id="username" />
   <br />
   <label for="password" accesskey="p">Password</label>
   :
   <input name="password" type="password" id="password" />
   <br />
   <input name="Submit" type="submit" value="Submit" />
   <br />
</form>

Step 3: Authentication
The loginADUser.cfm page contains code to authenticate the user against the AD server (see Listing 1).

Explanation
In AD, any valid user can bind to the service, which is accessible on port 389 and port 636 for a secured connection. For more on secured connections, please see the security section. The bind will work only if the security credentials are correct but will throw an error if the credentials are wrong.

The isLoggedIn variable holds a Boolean value that determines if a user's security credentials are valid on the domain or not. Now, when authentication is attempted, the try-catch combination catches the error that is thrown with wrong security credentials.

The code in Listing 1 kills two birds with one stone by authenticating and retrieving certain records at the same time.

A user's groups are stored in the memberof field. The membership information is stored in DN form, which you may have to parse to extract out. It's usually in this form:

CN=Support Team,OU=Distribution List,DC=bankx,DC=com,
CN=InfoTech,OU=Distribution List,DC=bankx,DC=com,
CN=Administrators,CN=Builtin,DC=bankx,DC=com,
CN=Domain Admins,CN=Builtin,DC=bankx,DC=com

The login code can be wrapped with a CFLOGIN tag and the parsed roles passed to CFLOGINUSER as roles. Otherwise, you can implement your own role system with session management.

Extending the AD
The AD, implementing the LDAP specifications, has default fields that hold information that is important to your users and applications. However, you might want to store some application-specific data along with the default information. AD has 15 blank fields that you can use: extensionAttribute1 to extensionAttribute15. You can also use some fields that are not important to your organization such as IPPhone.

If you use these fields, documentation of what you have done is very important. Also, note that the AD can be delicate; kindly consult with your Domain Administrator before writing anything to the database. An error could bring down the whole AD forest.

Tools
You can't do much with AD without using the ADSI Edit. Install this from the Windows Support Tools. The ADSI Edit allows you to peruse the attributes and data types of the objects in the AD. The AD has data types such as Integer, Integer8, DN, OID, Boolean, DirectoryString, and PrintableString. Consult documentations for what these stand for.

Security on AD/CF Integration
Implementing a real-life application requires that transmission of sensitive data between the servers should be encrypted. The AD supports the interchange of data between ColdFusion and itself via the Secured Socket Layer, SSL on port 636.

To use SSL, you must install an Enterprise Certificate Authority on any of the domain controllers in your organization. This forces the DCs to request certificates from ColdFusion whenever you use CFLDAP.

The next step is to install your security certificate on the ColdFusion server using the keytool. Go to the command prompt and navigate to <cfroot_install>\runtime\jre\bin directory and run the following command:

keytool -import -keystore cacerts -alias ldap -file ldap.crt -keypass bl19mq

Please refer to the Sun JDK for full documentation.

With the certificates in place, you must add the secure = "CFSSL_BASIC" attribute to your CFLDAP.

Summary
Your application can be much more elegant if you leverage on the AD. Not only will you deliver faster, you also future-proof your application so that it can effectively connect to other sources of user security profiles.

Ultimately, the users find life easier if they can always use your applications with just a single set of universal security credentials.

Important Links

More Stories By Adédèjì Olówè

Adedeji Olowe, a business intelligence expert, has been using ColdFusion for several years. He has experience developing and extending enterprise applications for companies in the financial industry as well as systems integration.

Comments (1) View Comments

Share your thoughts on this story.

Add your comment
You must be signed in to add a comment. Sign-in | Register

In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


Most Recent Comments
CFDJ News Desk 12/07/05 12:35:54 PM EST

Leveraging on Active Directory for ColdFusion Users. The majority of ColdFusion applications live far away, hidden, in enterprise fortresses as applications that small-to-large organizations depend on. In these organizations, especially the medium-to-large ones, there are well-established network infrastructures to manage the users, workstations, servers, etc.

@ThingsExpo Stories
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs ofte...
SYS-CON Events announced today that Systena America will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Systena Group has been in business for various software development and verification in Japan, US, ASEAN, and China by utilizing the knowledge we gained from all types of device development for various industries including smartphones (Android/iOS), wireless communication, security technology and IoT serv...
DevOps at Cloud Expo – being held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA – announces that its Call for Papers is open. Born out of proven success in agile development, cloud computing, and process automation, DevOps is a macro trend you cannot afford to miss. From showcase success stories from early adopters and web-scale businesses, DevOps is expanding to organizations of all sizes, including the world's largest enterprises – and delivering real r...
SYS-CON Events announced today that Hitachi Data Systems, a wholly owned subsidiary of Hitachi LTD., will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City. Hitachi Data Systems (HDS) will be featuring the Hitachi Content Platform (HCP) portfolio. This is the industry’s only offering that allows organizations to bring together object storage, file sync and share, cloud storage gateways, and sophisticated search and...
The 21st International Cloud Expo has announced that its Call for Papers is open. Cloud Expo, to be held October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, brings together Cloud Computing, Big Data, Internet of Things, DevOps, Digital Transformation, Machine Learning and WebRTC to one location. With cloud computing driving a higher percentage of enterprise IT budgets every year, it becomes increasingly important to plant your flag in this fast-expanding busin...
SYS-CON Events announced today that Technologic Systems Inc., an embedded systems solutions company, will exhibit at SYS-CON's @ThingsExpo, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Technologic Systems is an embedded systems company with headquarters in Fountain Hills, Arizona. They have been in business for 32 years, helping more than 8,000 OEM customers and building over a hundred COTS products that have never been discontinued. Technologic Systems’ pr...
SYS-CON Events announced today that Carbonite will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Carbonite protects your entire IT footprint with the right level of protection for each workload, ensuring lower costs and dependable solutions with DoubleTake and Evault.
New competitors, disruptive technologies, and growing expectations are pushing every business to both adopt and deliver new digital services. This ‘Digital Transformation’ demands rapid delivery and continuous iteration of new competitive services via multiple channels, which in turn demands new service delivery techniques – including DevOps. In this power panel at @DevOpsSummit 20th Cloud Expo, moderated by DevOps Conference Co-Chair Andi Mann, panelists will examine how DevOps helps to meet th...
SYS-CON Events announced today that Progress, a global leader in application development, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Enterprises today are rapidly adopting the cloud, while continuing to retain business-critical/sensitive data inside the firewall. This is creating two separate data silos – one inside the firewall and the other outside the firewall. Cloud ISVs oft...
SYS-CON Events announced today that CollabNet, a global leader in enterprise software development, release automation and DevOps solutions, will be a Bronze Sponsor of SYS-CON's 20th International Cloud Expo®, taking place from June 6-8, 2017, at the Javits Center in New York City, NY. CollabNet offers a broad range of solutions with the mission of helping modern organizations deliver quality software at speed. The company’s latest innovation, the DevOps Lifecycle Manager (DLM), supports Value S...
SYS-CON Events announced today that Cloudistics, an on-premises cloud computing company, has been named “Bronze Sponsor” of SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Cloudistics delivers a complete public cloud experience with composable on-premises infrastructures to medium and large enterprises. Its software-defined technology natively converges network, storage, compute, virtualization, and management into a ...
SYS-CON Events announced today that Ocean9will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Ocean9 provides cloud services for Backup, Disaster Recovery (DRaaS) and instant Innovation, and redefines enterprise infrastructure with its cloud native subscription offerings for mission critical SAP workloads.
Multiple data types are pouring into IoT deployments. Data is coming in small packages as well as enormous files and data streams of many sizes. Widespread use of mobile devices adds to the total. In this power panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists will look at the tools and environments that are being put to use in IoT deployments, as well as the team skills a modern enterprise IT shop needs to keep things running, get a handle on all this data, and deli...
We build IoT infrastructure products - when you have to integrate different devices, different systems and cloud you have to build an application to do that but we eliminate the need to build an application. Our products can integrate any device, any system, any cloud regardless of protocol," explained Peter Jung, Chief Product Officer at Pulzze Systems, in this SYS-CON.tv interview at @ThingsExpo, held November 1-3, 2016, at the Santa Clara Convention Center in Santa Clara, CA
DevOps is often described as a combination of technology and culture. Without both, DevOps isn't complete. However, applying the culture to outdated technology is a recipe for disaster; as response times grow and connections between teams are delayed by technology, the culture will die. A Nutanix Enterprise Cloud has many benefits that provide the needed base for a true DevOps paradigm.
SYS-CON Events announced today that Infranics will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Since 2000, Infranics has developed SysMaster Suite, which is required for the stable and efficient management of ICT infrastructure. The ICT management solution developed and provided by Infranics continues to add intelligence to the ICT infrastructure through the IMC (Infra Management Cycle) based on mathemat...
SYS-CON Events announced today that HTBase will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. HTBase (Gartner 2016 Cool Vendor) delivers a Composable IT infrastructure solution architected for agility and increased efficiency. It turns compute, storage, and fabric into fluid pools of resources that are easily composed and re-composed to meet each application’s needs. With HTBase, companies can quickly prov...
Internet of @ThingsExpo, taking place October 31 - November 2, 2017, at the Santa Clara Convention Center in Santa Clara, CA, is co-located with the 21st International Cloud Expo and will feature technical sessions from a rock star conference faculty and the leading industry players in the world. @ThingsExpo Silicon Valley Call for Papers is now open.
SYS-CON Events announced today that SoftLayer, an IBM Company, has been named “Gold Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York, New York. SoftLayer, an IBM Company, provides cloud infrastructure as a service from a growing number of data centers and network points of presence around the world. SoftLayer’s customers range from Web startups to global enterprises.
SYS-CON Events announced today that T-Mobile will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. As America's Un-carrier, T-Mobile US, Inc., is redefining the way consumers and businesses buy wireless services through leading product and service innovation. The Company's advanced nationwide 4G LTE network delivers outstanding wireless experiences to 67.4 million customers who are unwilling to compromise on ...