Click here to close now.

Welcome!

You will be redirected in 30 seconds or close now.

ColdFusion Authors: Yakov Fain, Maureen O'Gara, Nancy Y. Nee, Tad Anderson, Daniel Kaar

Related Topics: ColdFusion

ColdFusion: Article

Understanding Anonymous and Windows Authentication, and Applying It to Fusebox

Understanding Anonymous and Windows Authentication, and Applying It to Fusebox

This article applies to developers and site administrators working in an environment using Macromedia ColdFusion running on a Windows server using Internet Information Server 4.0 or better. Those who work in an intranet environment will be especially interested. It will conclude with information on specific Fusebox applications, though non-Fusebox users may find that it's applicable to them as well.

Anonymous Access vs Integrated Windows Authentication
With Internet Information Server 5.0, the built-in Web server provided with Windows 2000 Server, there are several user authentication schemes available. The ones we are interested in are Anonymous Access and Integrated Windows Authentication. These controls can be set at the Web site, virtual directory, and file levels, which can be useful for controlling access to any of these resources.

With Anonymous Access, all incoming requests to the Web site in question are mapped to a specific Windows user account designated for anonymous Web access. All interactions with the Web server then inherit whatever permissions are assigned to that anonymous account. Typically, this account is named "IUSR_{webserver name}," and is set with a limited set of permissions. Anonymous Access is typically used in a public Web server environment.

With Integrated Windows Authentication, when an Internet Explorer user browses a Web site that uses Integrated Windows Authentication, their current logon credentials are passed to the Web server, and all subsequent interactions with the Web server use those credentials. Thus, it is possible to make use of existing permissions within a Windows domain. Typically, Integrated Windows Authentication is used in an intranet environment, where an organization knows that all internal Web browsers will be Internet Explorer, and users log on to their Windows workstation with a specific username.

Why Have Both?
You may have a Web application in which the main portion of the site is for everybody, but certain sections require user authentication. Many applications fall into this category, where anybody can read, but only registered users can post messages, update records, etc. As we'll see later, you can have parts of your site set for anonymous authentication and others secured.

ColdFusion and User Authentication
You probably know that ColdFusion has had the capability to do user authentication since version 4.0 or so, using the <CFAU THENTICATE> tag. With the release of CFMX, <CFAUTHENTICATE> has been eliminated in favor of a new family of tags that provide somewhat similar functionality.

For whatever reason, many developers find that the built-in user authentication functions in ColdFusion do not meet their needs. The method described in this article does not make use of any of the built-in user authentication tags in ColdFusion.

ColdFusion, IIS and User Authentication
Many corporate intranets make use of the Microsoft family of products, and have an existing domain user authentication model in place. Typically, in the Microsoft-based intranet environment, user authentication is handled by setting IIS to use Integrated Windows Authentication instead of Allow Anonymous Access. All Web page requests by the current user then use that user's credentials.

When a Web browser requests a ColdFusion template, and that template (or directory or entire site) is marked as Allow Anonymous Access in IIS, the value of CGI.AUTH_USER is null. When that same CF template is called with Integrated Windows Authentication active, the value of CGI.AUTH_USER will be set to the DOMAIN\username of the current user (see Figure 1).

Fusebox - A Framework, Not a House
Newcomers and veterans to Fusebox find that much online discussion occurs over just what Fusebox is, or what is expected of it. As the official Fusebox Web site (www.fusebox.org) states, "Fusebox is a standard framework for building Web-based applications."

Because it's a framework, Fusebox provides the developer with a fantastic way of organizing a Web application, and that's it. Folks often get disappointed that Fusebox does not handle forms validation, wash the dishes, or milk the cow, but remember, Fusebox is a framework, nothing more. Many developers out there have come up with a cornucopia of components that do expand on the Fusebox framework, including components for handling user authentication. The technique described here doesn't require any specific components, just a rearranging of what already exists.

Fusebox Makes It Easy
One of the "rules" of Fusebox is that all browser requests point to index.cfm. You could have a thousand templates in a Fusebox application, with dozens of nested subdirectories, but all the end user will ever see is a URL pointing to "index.cfm" at the root as the target template. Many Fusebox developers wisely prevent users from accessing any other template in the application by adding code to Application.cfm to test for any .cfm template call other than index.cfm (see Listing 1).

In order to get what we want, an application that honors both Anonymous Access and Authenticated Access, we need to think outside the box - the Fusebox, that is. Instead of having all requests point to a single template, index.cfm, we will create a new template, indexsecure.cfm, for all requests requiring Authenticated Access:

  • All requests where Anonymous Access is desired will point to index.cfm
  • All requests where user authentication is desired will point to indexsecure.cfm

    Putting It All Together -
    Modifying an Existing Fusebox Application
    to Use Both Authentication Modes

    The following work with both older Fusebox 2.x and Fusebox 3 apps.

    Changes in Your Fusebox Application

  • First and foremost, make a backup copy of your existing Fusebox application before proceeding!
  • Make a copy of index.cfm and save it as indexsecure.cfm. There should now be index.cfm and indexsecure.cfm at the root level of your Fusebox application (see Figure 2).
  • Throughout the entire Fusebox application, change any index.cfm referrals to indexsecure.cfm where user authentication is desired.
  • Leave any referrals to index.cfm alone where anonymous access is desired.
  • Modify application.cfm so it will allow both index.cfm and indexsecure.cfm (see Listing 2).

    To prevent sneaky users from changing a call to indexsecure.cfm back to index.cfm in order to execute an unauthorized fuseaction, it is necessary to modify your Fusebox application so that only the appropriate fuseaction may be called. In a Fusebox application, actions - called fuseactions - are called by traversing a CFSWITCH which determines what action to take.

    With Fusebox 2.x applications, securing which fuseactions get called is easy. Simply delete the fuseactions requiring user authentication from index.cfm and add them to indexsecure.cfm.

    With Fusebox 3.x applications, this is a bit trickier, since index.cfm no longer houses the big CFSWITCH, which resides in FBX_Switch.cfm.We instead modify that file to control which fuseactions are secured and which are not (see Listing 3).

    Changes in File Level Permissions
    You may need to make some changes to permissions at the file level. In order to allow both the anonymous account and authenticated domain users access to your application, it is necessary to ensure that both the anonymous account and authenticated users have Read access. The images here show a "Before" and "After" of file-level permissions settings on a folder. This example works if your Anonymous Access account is a member of the "Domain Users" group. Consult with your domain security specialist before making changes to file-level permissions (see Figures 3 and 4).

    Changes in IIS
    For the directory holding the Fusebox application, select both Allow Anonymous Access and Integrated Windows Authentication. Why turn them both on? When a user passes from a user-authenticated template back to an Anonymous-Access template, they will be denied, since the browser session is now mapped to the current user's credentials instead of the anonymous account. By turning both options on, IIS will use either the anonymous user credentials, or authenticated user credentials (see Figures 5 and 6).

    Those familiar with Fusebox will see that this technique can be modified to work in a variety of ways, but the basic idea remains:

  • All requests where Anonymous Access is desired will point to index.cfm
  • All requests where user authentication is desired will point to indexsecure.cfm

    Note: The technique outlined here represents a deviation from accepted standard Fusebox technique. For more details on Fusebox, please visit www.fusebox.org.

  • More Stories By Alan McCollough

    Alan McCollough is a Web programmer at the Alaska Native Medical center in Anchorage and a recently certified ColdFusion (4.5) developer.

    Comments (0)

    Share your thoughts on this story.

    Add your comment
    You must be signed in to add a comment. Sign-in | Register

    In accordance with our Comment Policy, we encourage comments that are on topic, relevant and to-the-point. We will remove comments that include profanity, personal attacks, racial slurs, threats of violence, or other inappropriate material that violates our Terms and Conditions, and will block users who make repeated violations. We ask all readers to expect diversity of opinion and to treat one another with dignity and respect.


    @ThingsExpo Stories
    The Open Compute Project is a collective effort by Facebook and a number of players in the datacenter industry to bring lessons learned from the social media giant's giant IT deployment to the rest of the world. Datacenters account for 3% of global electricity consumption – about the same as all of Switzerland or the Czech Republic -- according to people I met at the recent Open Compute Summit in San Jose. With increasing mobility at the edge of the cloud and vast new dataflows being predicted with the growth of the Internet of Things (and The Coming Age of Many Zettabytes) in the near...
    GENBAND has announced that SageNet is leveraging the Nuvia platform to deliver Unified Communications as a Service (UCaaS) to its large base of retail and enterprise customers. Nuvia’s cloud-based solution provides SageNet’s customers with a full suite of business communications and collaboration tools. Two large national SageNet retail customers have recently signed up to deploy the Nuvia platform and the company will continue to sell the service to new and existing customers. Nuvia’s capabilities include HD voice, video, multimedia messaging, mobility, conferencing, Web collaboration, deskt...
    Wearable technology was dominant at this year’s International Consumer Electronics Show (CES) , and MWC was no exception to this trend. New versions of favorites, such as the Samsung Gear (three new products were released: the Gear 2, the Gear 2 Neo and the Gear Fit), shared the limelight with new wearables like Pebble Time Steel (the new premium version of the company’s previously released smartwatch) and the LG Watch Urbane. The most dramatic difference at MWC was an emphasis on presenting wearables as fashion accessories and moving away from the original clunky technology associated with t...
    The WebRTC Summit 2014 New York, to be held June 9-11, 2015, at the Javits Center in New York, NY, announces that its Call for Papers is open. Topics include all aspects of improving IT delivery by eliminating waste through automated business models leveraging cloud technologies. WebRTC Summit is co-located with 16th International Cloud Expo, @ThingsExpo, Big Data Expo, and DevOps Summit.
    SYS-CON Events announced today that Cisco, the worldwide leader in IT that transforms how people connect, communicate and collaborate, has been named “Gold Sponsor” of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Cisco makes amazing things happen by connecting the unconnected. Cisco has shaped the future of the Internet by becoming the worldwide leader in transforming how people connect, communicate and collaborate. Cisco and our partners are building the platform for the Internet of Everything by connecting the...
    15th Cloud Expo, which took place Nov. 4-6, 2014, at the Santa Clara Convention Center in Santa Clara, CA, expanded the conference content of @ThingsExpo, Big Data Expo, and DevOps Summit to include two developer events. IBM held a Bluemix Developer Playground on November 5 and ElasticBox held a Hackathon on November 6. Both events took place on the expo floor. The Bluemix Developer Playground, for developers of all levels, highlighted the ease of use of Bluemix, its services and functionality and provide short-term introductory projects that developers can complete between sessions.
    Temasys has announced senior management additions to its team. Joining are David Holloway as Vice President of Commercial and Nadine Yap as Vice President of Product. Over the past 12 months Temasys has doubled in size as it adds new customers and expands the development of its Skylink platform. Skylink leads the charge to move WebRTC, traditionally seen as a desktop, browser based technology, to become a ubiquitous web communications technology on web and mobile, as well as Internet of Things compatible devices.
    SYS-CON Events announced today that robomq.io will exhibit at SYS-CON's @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. robomq.io is an interoperable and composable platform that connects any device to any application. It helps systems integrators and the solution providers build new and innovative products and service for industries requiring monitoring or intelligence from devices and sensors.
    The list of ‘new paradigm’ technologies that now surrounds us appears to be at an all time high. From cloud computing and Big Data analytics to Bring Your Own Device (BYOD) and the Internet of Things (IoT), today we have to deal with what the industry likes to call ‘paradigm shifts’ at every level of IT. This is disruption; of course, we understand that – change is almost always disruptive.
    WebRTC is an up-and-coming standard that enables real-time voice and video to be directly embedded into browsers making the browser a primary user interface for communications and collaboration. WebRTC runs in a number of browsers today and is currently supported in over a billion installed browsers globally, across a range of platform OS and devices. Today, organizations that choose to deploy WebRTC applications and use a host machine that supports audio through USB or Bluetooth can use Plantronics products to connect and transit or receive the audio associated with the WebRTC session.
    Docker is an excellent platform for organizations interested in running microservices. It offers portability and consistency between development and production environments, quick provisioning times, and a simple way to isolate services. In his session at DevOps Summit at 16th Cloud Expo, Shannon Williams, co-founder of Rancher Labs, will walk through these and other benefits of using Docker to run microservices, and provide an overview of RancherOS, a minimalist distribution of Linux designed expressly to run Docker. He will also discuss Rancher, an orchestration and service discovery platf...
    Sonus Networks introduced the Sonus WebRTC Services Solution, a virtualized Web Real-Time Communications (WebRTC) offer, purpose-built for the Cloud. The WebRTC Services Solution provides signaling from WebRTC-to-WebRTC applications and interworking from WebRTC-to-Session Initiation Protocol (SIP), delivering advanced real-time communications capabilities on mobile applications and on websites, which are accessible via a browser.
    SYS-CON Events announced today that Aria Systems, the leading innovator in recurring revenue, has been named “Bronze Sponsor” of SYS-CON's @ThingsExpo, which will take place on June 9–11, 2015, at the Javits Center in New York, NY. Proven by the world’s most demanding enterprises, including AAA NCNU, Constant Contact, Falck, Hootsuite, Pitney Bowes, Telekom Denmark, and VMware, Aria helps enterprises grow their recurring revenue businesses. With Aria’s end-to-end active monetization platform, global brands can get to market faster with a wider variety of products and services, while maximizin...
    SYS-CON Media announced today that @WebRTCSummit Blog, the largest WebRTC resource in the world, has been launched. @WebRTCSummit Blog offers top articles, news stories, and blog posts from the world's well-known experts and guarantees better exposure for its authors than any other publication. @WebRTCSummit Blog can be bookmarked ▸ Here @WebRTCSummit conference site can be bookmarked ▸ Here
    SYS-CON Events announced today that Alert Logic, the leading provider of Security-as-a-Service solutions for the cloud, has been named “Bronze Sponsor” of SYS-CON's 16th International Cloud Expo® and DevOps Summit 2015 New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY, and the 17th International Cloud Expo® and DevOps Summit 2015 Silicon Valley, which will take place November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA.
    SYS-CON Events announced today that Vitria Technology, Inc. will exhibit at SYS-CON’s @ThingsExpo, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY. Vitria will showcase the company’s new IoT Analytics Platform through live demonstrations at booth #330. Vitria’s IoT Analytics Platform, fully integrated and powered by an operational intelligence engine, enables customers to rapidly build and operationalize advanced analytics to deliver timely business outcomes for use cases across the industrial, enterprise, and consumer segments.
    SYS-CON Events announced today that Solgenia will exhibit at SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York City, NY, and the 17th International Cloud Expo®, which will take place on November 3–5, 2015, at the Santa Clara Convention Center in Santa Clara, CA. Solgenia is the global market leader in Cloud Collaboration and Cloud Infrastructure software solutions. Designed to “Bridge the Gap” between Personal and Professional Social, Mobile and Cloud user experiences, our solutions help large and medium-sized organizations dr...
    SYS-CON Events announced today that Liaison Technologies, a leading provider of data management and integration cloud services and solutions, has been named "Silver Sponsor" of SYS-CON's 16th International Cloud Expo®, which will take place on June 9-11, 2015, at the Javits Center in New York, NY. Liaison Technologies is a recognized market leader in providing cloud-enabled data integration and data management solutions to break down complex information barriers, enabling enterprises to make smarter decisions, faster.
    Connected devices and the Internet of Things are getting significant momentum in 2014. In his session at Internet of @ThingsExpo, Jim Hunter, Chief Scientist & Technology Evangelist at Greenwave Systems, examined three key elements that together will drive mass adoption of the IoT before the end of 2015. The first element is the recent advent of robust open source protocols (like AllJoyn and WebRTC) that facilitate M2M communication. The second is broad availability of flexible, cost-effective storage designed to handle the massive surge in back-end data in a world where timely analytics is e...
    SYS-CON Events announced today that Akana, formerly SOA Software, has been named “Bronze Sponsor” of SYS-CON's 16th International Cloud Expo® New York, which will take place June 9-11, 2015, at the Javits Center in New York City, NY. Akana’s comprehensive suite of API Management, API Security, Integrated SOA Governance, and Cloud Integration solutions helps businesses accelerate digital transformation by securely extending their reach across multiple channels – mobile, cloud and Internet of Things. Akana enables enterprises to share data as APIs, connect and integrate applications, drive part...