Question

If I am using integration authentication in IIS, how can I determine if the current user is part of a specific active directory role, using ColdFusion.

This would be analogous to using the IsInRole() method of the User object in .net – how can it be done in ColdFusion

Answer 1

the only way to do this is to use cflap and query the active directory server to get a list of groups. after you’ve gotten the list, you will need to parse it to see if that user belongs to the group in question. below is some code i wrote with some comments for the people at work. values have been changed to protect the innocent.

<!--- getting the user login id --->
<cfset variables.thisuser = ListLast(cgi.AUTH_USER, "\")>
<!--- this is the group they must be a memberof --->
<cfset variables.groupname = "CN=<the group to search for>">
<!--- list of all groups that the user belongs to, will be populated later --->
<cfset variables.grouplist = "">

<cftry>
    <cfldap action="query"
        name="myldap"
        attributes="memberOf"
        start="OU=<your ou>,DC=<your dc>,DC=<your dc>"
        scope="subtree"
        filter="(sAMAccountName=#variables.thisuser#)"
        server="<your AD server ip>"
        port="<your AD server port>"
        username="<network login if required>"
        password="<network password if required>">

    <cfset variables.grouplist = myldap.memberOf>

<cfcatch>
    </cfcatch>
</cftry>

<cfif FindNoCase(variables.groupname, variables.grouplist)>

    <cfcookie name="SecurityCookieName" value="">

</cfif>