Making an auto-login on our Intranet; how secure is CGI.auth_user?

Question

We have CF10 on our Intranet webserver, and I'm developing the authentication system. The higher ups do not want the Intranet to ask for a login, and instead to pull the user's credentials from the CGI.auth_user variable since they log into a domain before they get to the intranet.

Thing is, this variable holds a value that lists the domain and username, but no password (ie, 'DOMAIN_NAME\user_name')

Well, I can run CFLDAP to determine if this user exists in our active directory and is not disabled/locked, but since a password is not captured/provided, the Intranet would have to assume that 'This is good enough for you to say who you are', and auto-log them in as that user.

My question is, how hard is it to spoof this value? If someone knows the username of an admin, and can alter the system to capture their credentials as 'DOMAIN_NAME\username_of_admin' then it would log them in as an admin.

I understand the risk of assuming the logged in person IS the person at the computer (we have many people who login as themselves, but let others use their PC while they are logged in, and informed these people that this is both against policy and that THEY are responsible for anything someone else does on their PC while logged in with their credentials)

BKBK · Answer

Aegis Kleais wrote:We have CF10 on our Intranet webserver, and I'm developing the authentication system. The higher ups do not want the Intranet to ask for a login, and instead to pull the user's credentials from the CGI.auth_user variable since they log into a domain before they get to the intranet. The most important questions on security are not based on which techniques to use. They are based on policy. Thus, if the domain trusts its users and the policy is that the intranet is just one of the resources within the domain, then there will be little need for a second layer of authentication.  Thing is, this variable holds a value that lists the domain and username, but no password (ie, 'DOMAIN_NAME\user_name')Well, I can run CFLDAP to determine if this user exists in our active directory and is not disabled/locked, but since a password is not captured/provided, the Intranet would have to assume that 'This is good enough for you to say who you are', and auto-log them in as that user.My question is, how hard is it to spoof this value? If someone knows the username of an admin, and can alter the system to capture their credentials as 'DOMAIN_NAME\username_of_admin' then it would log them in as an admin.It would be a difficult spoof. Suppose you intend on some malafide action on the intranet. You have managed to get hold of the username, DOMAIN_NAME\username_of_admin. To be able to pull off the spoof, you need to be in the domain, and have admin privileges. To have achieved that in the first place, you needed access to an admin password. We're now down to trust.

Sign up

To post, reply, or follow discussions, please sign in with your Adobe ID.

Sign in to Adobe Community

To post, reply, or follow discussions, please sign in with your Adobe ID.