Coldfusion 10 and IIS 7.5 and SiteMinder

Since the "sm_user" is a custom value, I wouldn't expect ColdFusion to expose it via CGI (although if it did previously in CF9 or earlier, I'd say then you have a valid bug).  However, it should still be accessible (just not in the CGI scope).  You might be able to see the "sm_user" value if you use getHTTPRequestData():

public string function getSM_User output='false'

      {

           var httpRequest = GetHttpRequestData();

           if(structKeyExists(httpRequest, "headers")

                && structKeyExists(httpRequest.headers, "sm_user"))

           {

                return httpRequest.headers.sm_user;

           }

return '';

}