How does cfloginuser actually work?

[lerxst3]

From what I can glean from the scattered documentation I can find on this, it seems that cfloginuser works by setting cookies. Is this correct? If so, what is this cookie called and what are it's properties? I'm having trouble finding this kind of information anywhere. What I'm ultimately trying to do is authenticate elsewhere (say, from Sharepoint) but make it so that the authentication persists so that the CF applications think they're already authenticated (provided everything was done in the same session).

[Newsgroup_User]

lerxst3 wrote:
> From what I can glean from the scattered documentation I can find on this, it
> seems that cfloginuser works by setting cookies. Is this correct? If so, what
> is this cookie called and what are it's properties?

As far as I know it just relies on the default ColdFusion session state
cookies, CFID and CFTOKEN OR jsessionid if one is using J2EE session
management. The former are persistent cookies by default while the
latter is a non-persistent memory cookie.

These tokens combined with the application name allows ColdFusion to
reference the persistent session state data of each user from request to
request.

HTH
Ian

[lerxst3]

So it sounds like I cannot do something like authenticate a user via Sharepoint and then "fake" the CF cookies to make the CF apps think the user is authenticated. In doing so, I would create CFID and CFTOKEN values that would be essentially meaningless. Is that correct?

[Newsgroup_User]

lerxst3 wrote:
> So it sounds like I cannot do something like authenticate a user via Sharepoint
> and then "fake" the CF cookies to make the CF apps think the user is
> authenticated. In doing so, I would create CFID and CFTOKEN values that would
> be essentially meaningless. Is that correct?
>

Most likely. You could share these values, but if the session has
expired in ColdFusion the values will be meaninless.

To share credentials between systems you have to do the work. There is
nothing preventing you from creating your own cookie, or any other data
sharing scheme, with the necessary information to pass the login details
back and forth.