Re: Cold Fusion SSO and File Access

From: Roger Abell (mvpNOSpam_at_asu.edu)
Date: 09/08/04

  • Next message: Joe: "Re: IIS cert denied" 
    Date: Tue, 7 Sep 2004 19:57:17 -0700

    The basic problem with that design is that the CF based
    SSO is private to the CF application, but they have not
    contained all content within the CF app.
    They could, I would think with modest redesign, make a
    containment page, a cfm so that it is within the CF SSO
    space, and this page is then used to display all of the
    currently non-cfm pages, with the same being renamed
    to some extension that IIS will not recognize/serve.
    This approach has obvious problems if the non-cfm pages
    are such as .asp, .doc, .pdf, etc..
    As I see it, this is a fundemental app design error, and
    the only real way to correct is where the error is. 

    -- 
Roger
"Jeff Ebeling" <jebeling@analysts.com> wrote in message
news:ek0Os8NlEHA.2764@TK2MSFTNGP11.phx.gbl...
> Hi all,
>
> I am a security engineer (new to the newsgroup) who just completed an Cold
> Fusion application security assessment. I found that the "application" was
> really a portal to multiple CF applications with single signon (SSO)
> implemented in CF. The web server is obviously IIS.
>
> The CF SSO implementation prevents access to (execution of) any files with
> the .cfm extension without valid CF cookies that are established via a CF
> login page. However, files used by, and linked from, the served pages
> without the .cfm extension are served by IIS regardless of whether or not
> the CF cookies associated with SSO are valid. All this is expected
behavior,
> but creates a serious security hole as any non-CF files can be accessed
> without logging in as long as the client knows the URL of the resource.
>
> I'm trying to find a good recommended solution that does not require
> extensive rewriting of all of the application code or require the user to
> authenticate more than once. I know that IIS can be set to protect
> individual files and directories, but to do so would require that the user
> authenticate to the windows server. I would much prefer a solution that
only
> required modification of the CF login script. Is there some way to have
the
> CF login script so the authentication and then set a non-persistent cookie
> on the client that IIS will then use for client authorization prior to
> serving files that are access contolled, without requesting that the user
> manually authenticate? Alternatively, can IIS be setup to redirect to a
Cold
> Fusion script to serve pages with specific extensions or in specific
> directories?
>
> There has got to be some easy way to do this, but I have yet to discover a
> solution. I would think that most CF apps running on IIS that use CF based
> authentication for security have the same flaw.
>
> My apologies, if this has been covered previously.
>
> Thanks,
>
> Jeff
>
>
  • Next message: Joe: "Re: IIS cert denied"

    Relevant Pages

    • Cold Fusion SSO and File Access
      ... I am a security engineer who just completed an Cold ... Fusion application security assessment. ... The web server is obviously IIS. ... authenticate to the windows server. ...
      (microsoft.public.inetserver.iis.security)
    • Re: WindowsTokenRoleProvider & Domain Groups
      ... Also, regarding the DLGs, it occurs to me to ask whether or not the groups ... your access token unless the groups are security enabled and the domain in ... ADFS = Active Directory Federated Services? ... SSO = Single Sign-On? ...
      (microsoft.public.dotnet.framework.aspnet.security)
    • SSO Tru64
      ... Tru64 and using SSO would have? ... Local School District that is privileged, ... exclusive property of the intended recipient or the Lakota Local School ... We are currently running enhanced security but are contemplating using ...
      (Tru64-UNIX-Managers)
    • Re: LDAP bind allowing old password for 1 hour
      ... application but just something we wrote to reproduce the problem. ... Unfortunately we do not have access to the code used in the SSO application. ... technique to authenticate other than using a simple LDAP bind to avoid this ... written web services that use .Net to authenticate a user and these do not ...
      (microsoft.public.windows.server.active_directory)
    • SSO Application Launching
      ... I want to create a web part that uses SSO to authenticate to several ... web-based applications. ... Tony ...
      (microsoft.public.sharepoint.portalserver.development)