>> This has caused a fair bit of developer confusion from what I gather.
agreed. Thanx, Tim for the clarification. It all makes sence now. cheers barry.b -----Original Message----- From: Tim McAuliffe [mailto:[EMAIL PROTECTED] Sent: Friday, 13 June 2003 12:06 PM To: CFAussie Mailing List Subject: [cfaussie] Re: getAuthUser() quick question Hi Barry > so the questions now are: > > * what does <cfloginuser name="xxx" password="yyy" roles=""> actually do > (what processes, is iis involved, is NTLM part of it, etc) <cfloginuser> creates a couple of session cookies and registers a username and list of roles for a given user. It's a CF based security system, so the whole process is essentially independent of the web server you're using. I say "essentially independent" because the GetAuthUser() function creates a bit of overlap between CF authentication and IIS authentication. If you use <cfloginuser username="x" ...>, the GetAuthUser() function will return the username you've registered with the 'username' attribute. If you don't use <cfloginuser>, GetAuthUser() will return the value of cgi.auth_user. This has caused a fair bit of developer confusion from what I gather. > > * how come I don't need <cfloginuser> when iis5 is using "integrated windows > authentication" ? It depends on how you want to do your security. IIS security runs when the server receives the template request, and before the template is passed to CF for processing. It's file system level access control, so it works for everything in the protected directory - CF templates, HTML pages, images etc. <cfloginuser> is CF code level authentication. The CF Server is responsible for it and it only affects CF templates within a given application. The main benefit of using it over IIS authentication is that you can register user roles as well and then use the IsUserInRole() function for roles based security. HTH Tim --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/ --- You are currently subscribed to cfaussie as: [EMAIL PROTECTED] To unsubscribe send a blank email to [EMAIL PROTECTED] MX Downunder AsiaPac DevCon - http://mxdu.com/
