ColdFusion setup for Terra Dotta?

[Cantor, Scott]

On 6/28/13 4:51 PM, "Don Faulkner" <donf at uark.edu> wrote:

>We're deploying Terra Dotta and I need some help with the Shib setup.
>This will be our first ColdFusion setup. Fair warning: I'm not a
>ColdFusion expert. I'm hoping someone else has been here before me and
>wouldn't mind just telling me how to do it. :)

I haven't ever used the modern (Java) version of Cold Fusion, so I don't
know much about it. It used to use JRun as the Java container, but that
could be long out of date information on my part.

At minimum, you have the usual Apache in front of "something" model like
with Tomcat or other Java containers, and you have to get it to accept
headers or environment data from Apache.

>Also, I'm confused because the integration example includes steps for
>transferring the Shib-person-uniqueid value into a cookie. I wonder if
>it's possible to change that cookie in order to impersonate another user.

At a brief glance, they are telling you to do something that's completely
insecure, yes. So I suppose I would take anything else they say with some
salt.

As an integration pattern, "protect the front door" is a common one, but
you have to have a secure way to connect things up to do that, usually via
some application API that creates a locally managed session.

-- Scott