Problem: Oracle auditing and Coldfusion pages.

jdbc; the user isn't requesting the connection, it is CF, which then keeps it open for other user requests -> it is the server who appears in the ora userenv properties (fairly standard for tiered arch). gb java

if u connected as a user to ora directly, then you'd see the users pc/id. Normally in these sort of tiers you would send info to the db to say "Hi, I'm bob, I'd like to update the my user record to super admin" and the db would the audit this and say something like  "ok" or "sorry bob, you don't have access to update yourself to this level"; I'd imagine you'r prolly doing this logic in the application and then saying to the db "Hi, I may/may not be bob, but I'm updating bob's user record to the super admin" and the db would say "No probs, done and I've recorded that bob told me to do it" - authentication vs authorisation!

I'm not familiar with Oracle; but I'll take a guess as to why the behavior is different between ASP and CF.  I suspect that the ASP pages access the database using Windows integrated authentication and impersonation of users.  If user bob@example.com logs into the ASP site the bob@example.com credentials are used for database access, and this is reflected in Oracle's auditing.  ColdFusion does not use integrated authentication so all data access is handled as the user credentials setup in the CF data source and using the IP of the CF server.  I don't think that this can be changed.  As far as I know CF does not support impersonation of Windows accounts.  However, I'm not an Oracle expect so if any of this is wrong please correct me.