Login / logout questions

[mattyb]

Hi -

Can some one give me a hand, I have been struggling with this problem for quite a while. I am using cf4.5, on NT with advanced security. I want to secure a directory using a security contex thats call pageworkers. I am validating the users from an LDAP server.

I have it working to a certain extent. A user can log in, and it validates the login. The problem lies with logging the user out. I have several questions about this.

My code will be listed below.

1. I created a logout.cfm, that basically clears the session, then sends the user back to the index.cfm page.
What do I need to do to have the application.cfm prompt the user to log back in. The Login page is in the application.cfm.

2. Should my logout.cfm, do something different?

3. Its been suggested that I create a new login.cfm page, but how do you take the login information from that and authenicate the user again? Do you then create a login_action.cfm page?

4. On all pages, what code do I need to put to autenitcate the user? Is there something that checks it?

5. In my book it talks about <cfcatch> If I catch a security problem, how do you send the user to the login screen.

6. In my application.cfm, theres a section that says &quot;showlogin&quot;, How do I force the login from this code.

Is there a better way.
Matt

Application.cfm

<cfapplication name=&quot;pw&quot;
clientmanagement=&quot;Yes&quot;
applicationtimeout=&quot;#CreateTime(0, 0, 1)#&quot;
sessionmanagement=&quot;yes&quot;
setclientcookies=&quot;no&quot;
sessiontimeout=&quot;#CreateTime(0, 0, 1)#&quot; >

<CFIF not IsAuthenticated()>
<!--- The user is not authenticated --->

<CFSET showLogin = &quot;No&quot;>
<CFIF IsDefined(&quot;form.username&quot and
IsDefined(&quot;form.password&quot>
<cfset session.username=&quot;#form.username#&quot;>
<cfset session.password=&quot;#form.password#&quot;>
<!--- The login form was submitted --->
<CFTRY>
<cfauthenticate setcookie=&quot;yes&quot;
throwonfailure=&quot;Yes&quot;
securitycontext=&quot;PageWorkers&quot;
username=&quot;#form.username#&quot;
password=&quot;#form.password#&quot;>

<CFCATCH TYPE=&quot;security&quot;>

<!--- Security error in login occurred,
show login again --->
<H3>Invalid Login</H3>
<CFSET showLogin = &quot;Yes&quot;>
</CFCATCH>
</CFTRY>

<CFELSE>
<!--- The login was not detected --->
<CFSET showLogin = &quot;Yes&quot;>
</CFIF>

<CFIF showLogin>
<!--- Recreate the url used to call this template --->
<CFSET url = &quot;#cgi.script_name#&quot;>
<CFIF cgi.query_string is not &quot;&quot;>
<CFSET url = url & &quot;?#cgi.query_string#&quot;>
</CFIF>

<!--- Populate the login with the recreated url --->

<CFOUTPUT>
<FORM ACTION=&quot;#url#&quot; METHOD=&quot;Post&quot;>
<TABLE>
<TR>
<TD>username:</TD>
<TD><INPUT TYPE=&quot;text&quot; NAME=&quot;username&quot;></TD>
</TR>

<TR>
<TD>password:</TD>
<TD><INPUT TYPE=&quot;password&quot; NAME=&quot;password&quot;></TD>
</TR>
</TABLE>
<INPUT TYPE=&quot;submit&quot; VALUE=&quot;Login&quot;>

</FORM>



</CFOUTPUT>
<CFABORT>
</CFIF>


logout.cfm
<CFSET StructClear(Session)>
<cfset StructDelete(Session, &quot;username&quot>

<cfset Structclear(Session)>
<meta http-equiv=&quot;REFRESH&quot; content=&quot;1; url=index.cfm?logout=yes&quot;>

 

[iza]

1- add in the application.cfm this line : <cfif logout eq &quot;yes&quot;> Please log back in </cfif>
2- why would you want he logout.cfm do something different ???
3- why would you create another login page ?????
4- the application.cfm file is INCLUDED in EVERY page and it DOES the authentication ... what's the point then ??
5- you already writtent the clause in the application.cfm !!! if it catches a security exception then you told it to do : <!--- Security error in login occurred,
show login again --->
<H3>Invalid Login</H3>
<CFSET showLogin = &quot;Yes&quot;>
what's the point then ??
6- did you really understood what you wrote in the application.cfm ??? because it's already doing so !!!!!

 

[mattyb]

Iza -

I'm doing something wrong then. Its not catching the security, and its not coming up with a login page. What usually happens after a logout, where the session is cleared, the url location goes to the index.cfm page, where it errors out because session.username is not present.

Matt

 

[iza]

i guess cfcatch must somehow stop the processing, because your code should set ShowLogin properly ...
the Application.cfm example in the doc is working really very well, and i don't remember if it uses a cfcatch or not ....
you can also try <CFIF showLogin eq &quot;Yes&quot;> but i don't think it'll change anything

 

[mattyb]

On the Logout Page, can I <CFSET ShowLogin = &quot;yes&quot;> and trick it to open the login screen?

 

[iza]

yes but it should show up anyway, as the form.username and form.password are NOT defined
see ? :

<CFIF not IsAuthenticated()>
<!--- The user is not authenticated --->
<CFSET showLogin = &quot;No&quot;>
<CFIF IsDefined(&quot;form.username&quot and IsDefined(&quot;form.password&quot>
no it's not, jump to the cfelse ...[/red]
<CFELSE>
<!--- The login was not detected --->
<CFSET showLogin = &quot;Yes&quot;>
</CFIF>

<CFIF showLogin eq &quot;Yes&quot;>
... should appear as showLogin=&quot;Yes&quot;

 

[mattyb]

Still having problems. I gave up on the old Code. The new Code I am using is from Mastering Cold Fusion 4.5. I cut and pasted the snippet from the cd and I changed the security context to match my name.

With this code, It still is not catching the security exception. I set the <CFCOOKIE NAME=&quot;username&quot; VALUE=&quot;&quot; EXPIRES=&quot;NOW&quot;><CFCOOKIE NAME=&quot;password&quot; VALUE=&quot;&quot; EXPIRES=&quot;NOW&quot;>, however, as I loop cflocate back to the index.cfm page, I would expect to have it catch the lack of cookies, and trigger the login page to come up. However, It errors on my index.cfm page because use a cookie.username Welcome <cfoutput>#cookie.username#</cfoutput>

Why isn't it catching the security?

The Code is pasted below.

Application.cfm

<!--- CHECK FOR A USERNAME --->
<CFPARAM name=&quot;HaveUsername&quot; default=&quot;Yes&quot;>

<CFIF IsDefined(&quot;Cookie.Username&quot>
<CFSET USERNAME=Cookie.Username>
<CFELSE>
<CFSET USERNAME=&quot;&quot;>
<CFIF IsDefined(&quot;Form.Username&quot>
<CFSET USERNAME=Form.Username>
<CFCOOKIE NAME=&quot;username&quot; VALUE=&quot;#Form.Username#&quot;>
<CFELSE>
<CFSET HaveUsername = &quot;No&quot;>
</CFIF>
</CFIF>

<!--- CHECK FOR A PASSWORD --->
<CFPARAM name=&quot;HavePassword&quot; default=&quot;Yes&quot;>

<CFIF IsDefined(&quot;Cookie.Password&quot>
<CFSET PASSWORD=Cookie.Password>
<CFELSE>
<CFSET PASSWORD=&quot;&quot;>
<CFIF IsDefined(&quot;Form.Password&quot>
<CFSET PASSWORD=Form.Password>
<CFCOOKIE NAME=&quot;password&quot; VALUE=&quot;#Form.Password#&quot;>
<CFELSE>
<CFSET HavePassword = &quot;No&quot;>
</CFIF>
</CFIF>

<!--- CHECK AUTHENTICATION STATUS AND IF NOT AUTHENTICATED HANDLE IT --->
<CFIF NOT IsAuthenticated()>

<!--- IF WE HAVE A PASSWORD AND USERNAME, TRY AUTHENTICATING --->
<CFIF HaveUsername and HavePassword>
<CFTRY>
<CFAUTHENTICATE
SECURITYCONTEXT=&quot;Pageworkers&quot;
USERNAME=&quot;#USERNAME#&quot;
PASSWORD=&quot;#PASSWORD#&quot;
SETCOOKIE=&quot;Yes&quot;>

<!--- IF AN EXCEPTION IS THROWN, HANDLE IT --->
<CFCATCH TYPE=&quot;Security&quot;>
<CFCOOKIE NAME=&quot;username&quot; VALUE=&quot;&quot; EXPIRES=&quot;NOW&quot;>
<CFCOOKIE NAME=&quot;password&quot; VALUE=&quot;&quot; EXPIRES=&quot;NOW&quot;>
<CFLOCATION URL=&quot;index.cfm&quot;>
</CFCATCH>
</CFTRY>
</CFIF>

<!--- OUTPUT A LOGIN FORM --->
<FORM ACTION=&quot;index.cfm&quot; METHOD=&quot;POST&quot;>
Username: <INPUT TYPE=text NAME=&quot;username&quot;><BR>
Password: <INPUT TYPE=password NAME=&quot;password&quot;><BR>
<INPUT TYPE=submit VALUE=&quot;LOGIN&quot;>
</FORM>

<CFABORT>

</CFIF>

<!--- USER IS AUTHENTICATED, SO WE CONTINUE --->

<CFAPPLICATION NAME=&quot;Pageworkers&quot;>


logout.cfm

<cfset Structclear(Session)>
<CFCOOKIE NAME=&quot;username&quot; VALUE=&quot;&quot; EXPIRES=&quot;NOW&quot;>
<CFCOOKIE NAME=&quot;password&quot; VALUE=&quot;&quot; EXPIRES=&quot;NOW&quot;>
<meta http-equiv=&quot;REFRESH&quot; content=&quot;1; url=index.cfm&quot;>

 

[iza]

i think you should allow user cookies
see your fisrt scfapplication tag was :
<cfapplication name=&quot;pw&quot;
clientmanagement=&quot;Yes&quot;
applicationtimeout=&quot;#CreateTime(0, 0, 1)#&quot;
sessionmanagement=&quot;yes&quot;
setclientcookies=&quot;no&quot;
sessiontimeout=&quot;#CreateTime(0, 0, 1)#&quot; >

 

[mattyb]

Iza-
I called to tech support from allaire. I'll let you know what my problem is, Thanks for helping me out.
Matt

 

[mattyb]

I solved the problem. Here is my log out page

logout.cfm
<cfset Structclear(Session)>
<cfset cookie.CFAUTH=&quot;&quot;>
<meta http-equiv=&quot;REFRESH&quot; content=&quot;1; url=index.cfm&quot;>