3 Replies Latest reply on Sep 5, 2008 6:26 AM by Newsgroup_User

    How does cfloginuser actually work?

    lerxst3
      From what I can glean from the scattered documentation I can find on this, it seems that cfloginuser works by setting cookies. Is this correct? If so, what is this cookie called and what are it's properties? I'm having trouble finding this kind of information anywhere. What I'm ultimately trying to do is authenticate elsewhere (say, from Sharepoint) but make it so that the authentication persists so that the CF applications think they're already authenticated (provided everything was done in the same session).
        • 1. Re: How does cfloginuser actually work?
          Level 7
          lerxst3 wrote:
          > From what I can glean from the scattered documentation I can find on this, it
          > seems that cfloginuser works by setting cookies. Is this correct? If so, what
          > is this cookie called and what are it's properties?

          As far as I know it just relies on the default ColdFusion session state
          cookies, CFID and CFTOKEN OR jsessionid if one is using J2EE session
          management. The former are persistent cookies by default while the
          latter is a non-persistent memory cookie.

          These tokens combined with the application name allows ColdFusion to
          reference the persistent session state data of each user from request to
          request.

          HTH
          Ian
          • 2. Re: How does cfloginuser actually work?
            lerxst3 Level 1
            So it sounds like I cannot do something like authenticate a user via Sharepoint and then "fake" the CF cookies to make the CF apps think the user is authenticated. In doing so, I would create CFID and CFTOKEN values that would be essentially meaningless. Is that correct?
            • 3. Re: How does cfloginuser actually work?
              Level 7
              lerxst3 wrote:
              > So it sounds like I cannot do something like authenticate a user via Sharepoint
              > and then "fake" the CF cookies to make the CF apps think the user is
              > authenticated. In doing so, I would create CFID and CFTOKEN values that would
              > be essentially meaningless. Is that correct?
              >

              Most likely. You could share these values, but if the session has
              expired in ColdFusion the values will be meaninless.

              To share credentials between systems you have to do the work. There is
              nothing preventing you from creating your own cookie, or any other data
              sharing scheme, with the necessary information to pass the login details
              back and forth.