Click here to close now.




















Welcome!

You will be redirected in 30 seconds or close now.

ColdFusion Authors: Yakov Fain, Maureen O'Gara, Nancy Y. Nee, Tad Anderson, Daniel Kaar

Related Topics: ColdFusion

ColdFusion: Article

Understanding Anonymous and Windows Authentication, and Applying It to Fusebox

Understanding Anonymous and Windows Authentication, and Applying It to Fusebox

This article applies to developers and site administrators working in an environment using Macromedia ColdFusion running on a Windows server using Internet Information Server 4.0 or better. Those who work in an intranet environment will be especially interested. It will conclude with information on specific Fusebox applications, though non-Fusebox users may find that it's applicable to them as well.

Anonymous Access vs Integrated Windows Authentication
With Internet Information Server 5.0, the built-in Web server provided with Windows 2000 Server, there are several user authentication schemes available. The ones we are interested in are Anonymous Access and Integrated Windows Authentication. These controls can be set at the Web site, virtual directory, and file levels, which can be useful for controlling access to any of these resources.

With Anonymous Access, all incoming requests to the Web site in question are mapped to a specific Windows user account designated for anonymous Web access. All interactions with the Web server then inherit whatever permissions are assigned to that anonymous account. Typically, this account is named "IUSR_{webserver name}," and is set with a limited set of permissions. Anonymous Access is typically used in a public Web server environment.

With Integrated Windows Authentication, when an Internet Explorer user browses a Web site that uses Integrated Windows Authentication, their current logon credentials are passed to the Web server, and all subsequent interactions with the Web server use those credentials. Thus, it is possible to make use of existing permissions within a Windows domain. Typically, Integrated Windows Authentication is used in an intranet environment, where an organization knows that all internal Web browsers will be Internet Explorer, and users log on to their Windows workstation with a specific username.

Why Have Both?
You may have a Web application in which the main portion of the site is for everybody, but certain sections require user authentication. Many applications fall into this category, where anybody can read, but only registered users can post messages, update records, etc. As we'll see later, you can have parts of your site set for anonymous authentication and others secured.

ColdFusion and User Authentication
You probably know that ColdFusion has had the capability to do user authentication since version 4.0 or so, using the <CFAU THENTICATE> tag. With the release of CFMX, <CFAUTHENTICATE> has been eliminated in favor of a new family of tags that provide somewhat similar functionality.

For whatever reason, many developers find that the built-in user authentication functions in ColdFusion do not meet their needs. The method described in this article does not make use of any of the built-in user authentication tags in ColdFusion.

ColdFusion, IIS and User Authentication
Many corporate intranets make use of the Microsoft family of products, and have an existing domain user authentication model in place. Typically, in the Microsoft-based intranet environment, user authentication is handled by setting IIS to use Integrated Windows Authentication instead of Allow Anonymous Access. All Web page requests by the current user then use that user's credentials.

When a Web browser requests a ColdFusion template, and that template (or directory or entire site) is marked as Allow Anonymous Access in IIS, the value of CGI.AUTH_USER is null. When that same CF template is called with Integrated Windows Authentication active, the value of CGI.AUTH_USER will be set to the DOMAIN\username of the current user (see Figure 1).

Fusebox - A Framework, Not a House
Newcomers and veterans to Fusebox find that much online discussion occurs over just what Fusebox is, or what is expected of it. As the official Fusebox Web site (www.fusebox.org) states, "Fusebox is a standard framework for building Web-based applications."

Because it's a framework, Fusebox provides the developer with a fantastic way of organizing a Web application, and that's it. Folks often get disappointed that Fusebox does not handle forms validation, wash the dishes, or milk the cow, but remember, Fusebox is a framework, nothing more. Many developers out there have come up with a cornucopia of components that do expand on the Fusebox framework, including components for handling user authentication. The technique described here doesn't require any specific components, just a rearranging of what already exists.

Fusebox Makes It Easy
One of the "rules" of Fusebox is that all browser requests point to index.cfm. You could have a thousand templates in a Fusebox application, with dozens of nested subdirectories, but all the end user will ever see is a URL pointing to "index.cfm" at the root as the target template. Many Fusebox developers wisely prevent users from accessing any other template in the application by adding code to Application.cfm to test for any .cfm template call other than index.cfm (see Listing 1).

In order to get what we want, an application that honors both Anonymous Access and Authenticated Access, we need to think outside the box - the Fusebox, that is. Instead of having all requests point to a single template, index.cfm, we will create a new template, indexsecure.cfm, for all requests requiring Authenticated Access:

  • All requests where Anonymous Access is desired will point to index.cfm
  • All requests where user authentication is desired will point to indexsecure.cfm

    Putting It All Together -
    Modifying an Existing Fusebox Application
    to Use Both Authentication Modes

    The following work with both older Fusebox 2.x and Fusebox 3 apps.

    Changes in Your Fusebox Application

  • First and foremost, make a backup copy of your existing Fusebox application before proceeding!
  • Make a copy of index.cfm and save it as indexsecure.cfm. There should now be index.cfm and indexsecure.cfm at the root level of your Fusebox application (see Figure 2).
  • Throughout the entire Fusebox application, change any index.cfm referrals to indexsecure.cfm where user authentication is desired.
  • Leave any referrals to index.cfm alone where anonymous access is desired.
  • Modify application.cfm so it will allow both index.cfm and indexsecure.cfm (see Listing 2).

    To prevent sneaky users from changing a call to indexsecure.cfm back to index.cfm in order to execute an unauthorized fuseaction, it is necessary to modify your Fusebox application so that only the appropriate fuseaction may be called. In a Fusebox application, actions - called fuseactions - are called by traversing a CFSWITCH which determines what action to take.

    With Fusebox 2.x applications, securing which fuseactions get called is easy. Simply delete the fuseactions requiring user authentication from index.cfm and add them to indexsecure.cfm.

    With Fusebox 3.x applications, this is a bit trickier, since index.cfm no longer houses the big CFSWITCH, which resides in FBX_Switch.cfm.We instead modify that file to control which fuseactions are secured and which are not (see Listing 3).

    Changes in File Level Permissions
    You may need to make some changes to permissions at the file level. In order to allow both the anonymous account and authenticated domain users access to your application, it is necessary to ensure that both the anonymous account and authenticated users have Read access. The images here show a "Before" and "After" of file-level permissions settings on a folder. This example works if your Anonymous Access account is a member of the "Domain Users" group. Consult with your domain security specialist before making changes to file-level permissions (see Figures 3 and 4).

    Changes in IIS
    For the directory holding the Fusebox application, select both Allow Anonymous Access and Integrated Windows Authentication. Why turn them both on? When a user passes from a user-authenticated template back to an Anonymous-Access template, they will be denied, since the browser session is now mapped to the current user's credentials instead of the anonymous account. By turning both options on, IIS will use either the anonymous user credentials, or authenticated user credentials (see Figures 5 and 6).

    Those familiar with Fusebox will see that this technique can be modified to work in a variety of ways, but the basic idea remains:

  • All requests where Anonymous Access is desired will point to index.cfm
  • All requests where user authentication is desired will point to indexsecure.cfm

    Note: The technique outlined here represents a deviation from accepted standard Fusebox technique. For more details on Fusebox, please visit www.fusebox.org.

  • More Stories By Alan McCollough

    Alan McCollough is a Web programmer at the Alaska Native Medical center in Anchorage and a recently certified ColdFusion (4.5) developer.

    Comments (0)

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


    @ThingsExpo Stories
    SYS-CON Events announced today that HPM Networks will exhibit at the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. For 20 years, HPM Networks has been integrating technology solutions that solve complex business challenges. HPM Networks has designed solutions for both SMB and enterprise customers throughout the San Francisco Bay Area.
    For IoT to grow as quickly as analyst firms’ project, a lot is going to fall on developers to quickly bring applications to market. But the lack of a standard development platform threatens to slow growth and make application development more time consuming and costly, much like we’ve seen in the mobile space. In his session at @ThingsExpo, Mike Weiner, Product Manager of the Omega DevCloud with KORE Telematics Inc., discussed the evolving requirements for developers as IoT matures and conducted a live demonstration of how quickly application development can happen when the need to comply wit...
    The Internet of Everything (IoE) brings together people, process, data and things to make networked connections more relevant and valuable than ever before – transforming information into knowledge and knowledge into wisdom. IoE creates new capabilities, richer experiences, and unprecedented opportunities to improve business and government operations, decision making and mission support capabilities.
    Explosive growth in connected devices. Enormous amounts of data for collection and analysis. Critical use of data for split-second decision making and actionable information. All three are factors in making the Internet of Things a reality. Yet, any one factor would have an IT organization pondering its infrastructure strategy. How should your organization enhance its IT framework to enable an Internet of Things implementation? In his session at @ThingsExpo, James Kirkland, Red Hat's Chief Architect for the Internet of Things and Intelligent Systems, described how to revolutionize your archit...
    MuleSoft has announced the findings of its 2015 Connectivity Benchmark Report on the adoption and business impact of APIs. The findings suggest traditional businesses are quickly evolving into "composable enterprises" built out of hundreds of connected software services, applications and devices. Most are embracing the Internet of Things (IoT) and microservices technologies like Docker. A majority are integrating wearables, like smart watches, and more than half plan to generate revenue with APIs within the next year.
    Growth hacking is common for startups to make unheard-of progress in building their business. Career Hacks can help Geek Girls and those who support them (yes, that's you too, Dad!) to excel in this typically male-dominated world. Get ready to learn the facts: Is there a bias against women in the tech / developer communities? Why are women 50% of the workforce, but hold only 24% of the STEM or IT positions? Some beginnings of what to do about it! In her Opening Keynote at 16th Cloud Expo, Sandy Carter, IBM General Manager Cloud Ecosystem and Developers, and a Social Business Evangelist, d...
    In his keynote at 16th Cloud Expo, Rodney Rogers, CEO of Virtustream, discussed the evolution of the company from inception to its recent acquisition by EMC – including personal insights, lessons learned (and some WTF moments) along the way. Learn how Virtustream’s unique approach of combining the economics and elasticity of the consumer cloud model with proper performance, application automation and security into a platform became a breakout success with enterprise customers and a natural fit for the EMC Federation.
    The Internet of Things is not only adding billions of sensors and billions of terabytes to the Internet. It is also forcing a fundamental change in the way we envision Information Technology. For the first time, more data is being created by devices at the edge of the Internet rather than from centralized systems. What does this mean for today's IT professional? In this Power Panel at @ThingsExpo, moderated by Conference Chair Roger Strukhoff, panelists addressed this very serious issue of profound change in the industry.
    Discussions about cloud computing are evolving into discussions about enterprise IT in general. As enterprises increasingly migrate toward their own unique clouds, new issues such as the use of containers and microservices emerge to keep things interesting. In this Power Panel at 16th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists addressed the state of cloud computing today, and what enterprise IT professionals need to know about how the latest topics and trends affect their organization.
    It is one thing to build single industrial IoT applications, but what will it take to build the Smart Cities and truly society-changing applications of the future? The technology won’t be the problem, it will be the number of parties that need to work together and be aligned in their motivation to succeed. In his session at @ThingsExpo, Jason Mondanaro, Director, Product Management at Metanga, discussed how you can plan to cooperate, partner, and form lasting all-star teams to change the world and it starts with business models and monetization strategies.
    Converging digital disruptions is creating a major sea change - Cisco calls this the Internet of Everything (IoE). IoE is the network connection of People, Process, Data and Things, fueled by Cloud, Mobile, Social, Analytics and Security, and it represents a $19Trillion value-at-stake over the next 10 years. In her keynote at @ThingsExpo, Manjula Talreja, VP of Cisco Consulting Services, discussed IoE and the enormous opportunities it provides to public and private firms alike. She will share what businesses must do to thrive in the IoE economy, citing examples from several industry sectors.
    There will be 150 billion connected devices by 2020. New digital businesses have already disrupted value chains across every industry. APIs are at the center of the digital business. You need to understand what assets you have that can be exposed digitally, what their digital value chain is, and how to create an effective business model around that value chain to compete in this economy. No enterprise can be complacent and not engage in the digital economy. Learn how to be the disruptor and not the disruptee.
    Akana has released Envision, an enhanced API analytics platform that helps enterprises mine critical insights across their digital eco-systems, understand their customers and partners and offer value-added personalized services. “In today’s digital economy, data-driven insights are proving to be a key differentiator for businesses. Understanding the data that is being tunneled through their APIs and how it can be used to optimize their business and operations is of paramount importance,” said Alistair Farquharson, CTO of Akana.
    Business as usual for IT is evolving into a "Make or Buy" decision on a service-by-service conversation with input from the LOBs. How does your organization move forward with cloud? In his general session at 16th Cloud Expo, Paul Maravei, Regional Sales Manager, Hybrid Cloud and Managed Services at Cisco, discusses how Cisco and its partners offer a market-leading portfolio and ecosystem of cloud infrastructure and application services that allow you to uniquely and securely combine cloud business applications and services across multiple cloud delivery models.
    The enterprise market will drive IoT device adoption over the next five years. In his session at @ThingsExpo, John Greenough, an analyst at BI Intelligence, division of Business Insider, analyzed how companies will adopt IoT products and the associated cost of adopting those products. John Greenough is the lead analyst covering the Internet of Things for BI Intelligence- Business Insider’s paid research service. Numerous IoT companies have cited his analysis of the IoT. Prior to joining BI Intelligence, he worked analyzing bank technology for Corporate Insight and The Clearing House Payment...
    "Optimal Design is a technology integration and product development firm that specializes in connecting devices to the cloud," stated Joe Wascow, Co-Founder & CMO of Optimal Design, in this SYS-CON.tv interview at @ThingsExpo, held June 9-11, 2015, at the Javits Center in New York City.
    SYS-CON Events announced today that CommVault has been named “Bronze Sponsor” of SYS-CON's 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. A singular vision – a belief in a better way to address current and future data management needs – guides CommVault in the development of Singular Information Management® solutions for high-performance data protection, universal availability and simplified management of data on complex storage networks. CommVault's exclusive single-platform architecture gives companies unp...
    Electric Cloud and Arynga have announced a product integration partnership that will bring Continuous Delivery solutions to the automotive Internet-of-Things (IoT) market. The joint solution will help automotive manufacturers, OEMs and system integrators adopt DevOps automation and Continuous Delivery practices that reduce software build and release cycle times within the complex and specific parameters of embedded and IoT software systems.
    "ciqada is a combined platform of hardware modules and server products that lets people take their existing devices or new devices and lets them be accessible over the Internet for their users," noted Geoff Engelstein of ciqada, a division of Mars International, in this SYS-CON.tv interview at @ThingsExpo, held June 9-11, 2015, at the Javits Center in New York City.
    Internet of Things is moving from being a hype to a reality. Experts estimate that internet connected cars will grow to 152 million, while over 100 million internet connected wireless light bulbs and lamps will be operational by 2020. These and many other intriguing statistics highlight the importance of Internet powered devices and how market penetration is going to multiply many times over in the next few years.