Skip to main content
C
cbowie75
Participant
October 2, 2013
Answered

Enabling CAC authentication using IIS7 and CF10

  • October 2, 2013
  • 2 replies
  • 3513 views

I am currently working on a web application written in CF running on IIS7 and CF10 server.  We need to replace our login page where our users supply username and password w/ CAC login.  The goial being for users to be prompted to enter thier 6 digit PIN assciated w/ their CAC to login to the application as opposed to the username and password thery are currently using.  If anyone has any suggestions on how to accomplish it would be much appreciated.

This topic has been closed for replies.
Correct answer Donald Baert

The first step in being able to login with a CAC is making sure that the correct certificates are loaded on your web server.  If the right certs are there and the server can read the card it will store the users last name, first name and a unique user ID off of the card at the end of the CGI.cert_subject variable.  We added a field to our user database to store this number.  We then strip the name and number out of the CGI.cert_subject  and compare it to the database.  But the key is getting the right certificates on your server, require SSL and Require (or accept) certificate on the SSL Settings. Also, you must disable anonymous authentication and enable windows authentication if you require everyone to login.

Hope this gets you started, if not let me know and I can provide some of our code snippets.

2 replies

D
Donald BaertCorrect answer
Inspiring
October 2, 2013

The first step in being able to login with a CAC is making sure that the correct certificates are loaded on your web server.  If the right certs are there and the server can read the card it will store the users last name, first name and a unique user ID off of the card at the end of the CGI.cert_subject variable.  We added a field to our user database to store this number.  We then strip the name and number out of the CGI.cert_subject  and compare it to the database.  But the key is getting the right certificates on your server, require SSL and Require (or accept) certificate on the SSL Settings. Also, you must disable anonymous authentication and enable windows authentication if you require everyone to login.

Hope this gets you started, if not let me know and I can provide some of our code snippets.

C
cbowie75Author
Participant
October 3, 2013

Thanks Donald!

We were thinking that was the way to go.  Any pieces of code you'd be willing to share would be great.  Are you on GitHub?

D
Donald Baert
Inspiring
October 3, 2013

Sorry, not on github but this snippet should get you the unique user number, their first name and last name.

<cfif CGI.auth_user NEQ ''>

    <!--- Attempting to capture the User Number from the CGI cert_subject. --->

    <!--- Gives us the beginning and end of the User Number--->

    <cfset vCert = REFind('(\.[0-9]{10,10})',CGI.cert_subject,1,"TRUE")>

     <!--- Get the  User Number --->

    <cfset session.vUN = mid(CGI.cert_subject,vCert.pos[1]+1,vCert.len[1]-1)>

    <!--- find where the CN= starts  --->

    <cfset vCN = findnocase('CN=',CGI.cert_subject,1)>

    <!--- grab the user's name from the CN --->

    <cfset names = mid(CGI.cert_subject,vCN+3,len(CGI.cert_subject)- vCN - 3 - 10)>

    <!--- find the store the domain name and user name from CGI.AUTH_USER  --->

    <cfif find("\",CGI.AUTH_USER) gt 0>

        <cfset domain = left(CGI.AUTH_USER,find("\",CGI.AUTH_USER,1)-1)>

        <cfset SESSION.vDomain = domain>

        <cfset user = right(CGI.AUTH_USER,len(CGI.AUTH_USER)-find("\",cgi.AUTH_USER,1))>

    <cfelse>

        <cfset domain = "">

        <cfset SESSION.vDomain = domain>

        <cfset user = CGI.AUTH_USER>

    </cfif>

    <!--- Split the first name and last name from the name variable captured from the CGI.AUTH_USER --->

    <cfif findnocase('.',names,1) gt 1>

        <cfset SESSION.vFirstName = right(names,len(names)-findnocase('.',names,1))>

        <cfset SESSION.vLastName = left(names,findnocase('.',names,1)-1)>

    <cfelse>

        <cfset SESSION.vFirstName = "Anonymous">

        <cfset SESSION.vLastName = names>

    </cfif>

   

</cfif>

A
Aegis_Kleais
Inspiring
October 2, 2013

I thought CAC was just the card number + pin, right?

The CAC is scanned and the user enters a pin number.  Since CF cannot interact with the CAC, can the hardware be programmed to send the information to a CFC via an HTTP request?

Like //server/folder/file.cfc?method=authenticateCACRequest&cardID=XXXXXXXXXXXXXXXXXXXXXXXXXXX&pin=YYYYYY

Then just write the code to check against the database and process the response.

Terms & ConditionsAccessibility statement
Using the community Terms of use Privacy Cookie preferences Do not sell or share my personal information ad choicesAdChoices