Example Of User Authentication And Authorization - MACROMEDIA COLDFUSION 4.5-DEVELOPING WEB Develop Manual

270
USERNAME — The username of the user to impersonate.
PASSWORD — The password of the user to impersonate.
TYPE — Indicates the type of impersonation to implement, application-level or
operating-system-level. Application-level impersonation lets you assume the
rights assigned to a ColdFusion user by a specified security context. Operating-
system-level impersonation lets you assume the rights assigned to a Windows
NT user by a specified Windows NT Domain. (Operating-system-level
impersonation is not currently available for UNIX.)
In addition, CFIMPERSONATE has one optional attribute:
THROWONFAILURE — Indicates whether ColdFusion throws an exception of
type Security if authentication fails. Default is Yes.
Example
The following example reads a protected file because the ColdFusion user "pfoley" has
been granted access to the file by the security context "MyContext." If the user cannot
be authenticated, ColdFusion throws a SECURITY exception.
<CFIMPERSONATE SECURITYCONTEXT="MyContext"
USERNAME="pfoley"
PASSWORD="admin"
TYPE= "CF"
THROWONFAILURE= "Yes">
<CFFILE FILE="#readFile#" ACTION="read" VARIABLE="text">
<CFOUTPUT>
</CFOUTPUT>
</CFIMPERSONATE>

Example of User Authentication and Authorization

The following sample pages illustrate how a developer might implement user security
by authenticating users and then allowing users to see/use only the resources they are
authorized to use.
In this example, a user requests a page in an application named Orders, which is part
of a security context, also named Orders, that governs pages and resources for an order
tracking application.
User security is generally handled in two steps:
First, the
authenticated. If not, we present a login form and the user must submit a
username and password for authentication.
The file contains the following text:<BR>#text#<BR>
Application.cfm
Developing Web Applications with ColdFusion
page checks to see if the current user is