tracker issue : CF-4202619

Problem Description:

A user with no rights in an area protected by NTFS permissions gets prompted for credentials (as they should), but once their credentials are entered, they get  access to "protected" CFM files. The same user with no rights accessing other content types (htm, asp, aspx, etc) in the protected area gets "Access denied" after entering credentials.  ColdFusion is not doing "authorization" to prevent their access to restricted CF content.

Steps to Reproduce:

    1. Find or create user account with no special rights for testing.
       This user should only have Anonymous access where allowed.

    2. Create a test subdirectory in web space.

    3. Configure the test subdirectory in IIS and NTFS:

         IIS Administrator:
           Change the test directory Anonymous Authentication to disabled.
           Change the test directory Windows Authentication to enabled.

         File system test directory NTFS security settings:
           Break inheritance
           Remove MACHINE/Users group (or similar) access

    4. Create a trivial test.cfm file in the test directory. 
         Using CF to display the authenticated user helpful.

           <p>This is test.cfm
           <cfoutput>
             <p>CGI.AUTH_USER is: #cgi.auth_user#
           </cfoutput>

     5. Test using Internet Explorer

        a. Enter URL for test.cfm

        b. When prompted for credentials, enter username and password
           for the user that has no rights. If prompted again, 
           enter the username and password one or two times more
           until a server response for the page is displayed.

        Note that Internet Explorer may not prompt for
        user credentials if "Automatic logon with current
        user name and password" is enabled in Internet Explorer.
        Internet Explorer may also remember and use the credentials
        for subsequent page request in the same session.

Actual Result:

    User sees restricted content. For test.cfm as above:

        This is test.cfm
        CGI.AUTH_USER is: domain\username (for user without rights)   

Expected Result:

      401.3 Access Denied or Not Authorized error

Any Workarounds:

    No acceptable workarounds were found.

    The IIS "URL Authorization" server role approach
    shouldn't be required and is not the desired solution.

    It may be possible to configure Tomcat to do NTFS authorization.

    The applications could be re-designed to lookup the authenticated
    user from CGI.AUTH_USER in a database of users.

Attachments:

Comments: