How does cfloginuser actually work?

lerxst3 wrote:
> So it sounds like I cannot do something like authenticate a user via Sharepoint
> and then "fake" the CF cookies to make the CF apps think the user is
> authenticated. In doing so, I would create CFID and CFTOKEN values that would
> be essentially meaningless. Is that correct?
>

Most likely. You could share these values, but if the session has
expired in ColdFusion the values will be meaninless.

To share credentials between systems you have to do the work. There is
nothing preventing you from creating your own cookie, or any other data
sharing scheme, with the necessary information to pass the login details
back and forth.

So it sounds like I cannot do something like authenticate a user via Sharepoint and then "fake" the CF cookies to make the CF apps think the user is authenticated. In doing so, I would create CFID and CFTOKEN values that would be essentially meaningless. Is that correct?

lerxst3 wrote:
> From what I can glean from the scattered documentation I can find on this, it
> seems that cfloginuser works by setting cookies. Is this correct? If so, what
> is this cookie called and what are it's properties?

As far as I know it just relies on the default ColdFusion session state
cookies, CFID and CFTOKEN OR jsessionid if one is using J2EE session
management. The former are persistent cookies by default while the
latter is a non-persistent memory cookie.

These tokens combined with the application name allows ColdFusion to
reference the persistent session state data of each user from request to
request.

HTH
Ian