
343
DEVELOPING
COLDFUSION 9 APPLICATIONS
Developing CFML Applications
Las
t
upda
te
d 8/5/2010
Note:
Dreamweaver and Studio MX do not support NTLM security with RDS. Therefore, you cannot use RDS with these
applications if the ColdFusion RDS servlet (cf_root/CFIDE/main/ide.cfm) is in a directory that is protected using NTLM
security.
In web server authentication, the web server requires the user to log in to access pages in a particular directory, as
follows:
1
When the user first requests a page in the secured directory, the web server notifies the browser that the requested
page requires credentials (a user ID and password).
Basic HTTP authentication sends the user ID and password in a base64-encoded string with each request. Use SSL
(Secure Sockets Layer) for all page transactions, to protect the user ID and password from unauthorized access. For
more information on SSL and the keytool utility, see “
About LDAP Server Security
” on page 475.
2
The browser prompts the user for the credentials.
3
The user supplies the credentials and the browser send the information back to the web server along with the
original request.
4
The web server checks the user ID and password, using its own user authentication mechanism.
5
If the user logs in successfully, the browser caches the authentication information and sends it in an HTTP
Authorization header with every subsequent page request from the user.
6
The web server processes the requested page and all future page requests from the browser that contain the HTTP
Authorization header, if it is valid for the requested page.
You can use web server authentication without using any ColdFusion security features. In this case, you configure and
manage all user security through the web server’s interfaces.
You can also use web server authentication with ColdFusion application authentication, and thus use ColdFusion
security for authorization. If the web server uses basic HTML authentication, the ColdFusion
cflogin
tag provides
access to the user ID and password that the user entered to log in to the web server. If the web server uses Digest or
NTLM authentication, the
cflogin
tag normally gets the user ID, but not the password.
As a result, your application rely on the web server to authenticate the user against its user and password information,
and does not have to display a login page. You use the
cflogin
and
cfloginuser
tags to log the user into the
ColdFusion user security system, and use the
IsUserInAnyRole
and
GetAuthUser
functions to ensure user
authorization. For more information on this form of security, see “
A web server authentication security scenario
” on
page 349.
Note:
If a user has logged in using web server authentication and has not logged in using ColdFusion application
authentication, the
GetAuthUser
tag returns the web server user ID. You could use this feature to combine web server
authentication with application authorization based on the user’s ID.
Application authentication
With application authentication, you do not rely on the web server to enforce application security. The application
performs all user authentication and authorization. The application displays a login page, checks the user’s identity
and login against its own authorization store, such as an LDAP directory or database, and logs the user into
ColdFusion using the
cfloginuser
tag. The application then uses the
IsUserInAnyRole
and
GetAuthUser
functions
to check the user’s roles or identity for authorization before running a ColdFusion page or specific code on a page. For
an example of application authentication use, see “
An application authentication security scenario
” on page 350.
Содержание COLDFUSION 9
Страница 1: ...Developing Applications ADOBE COLDFUSION 9...