"Stephen Baldwin of features." - Coffee meet monitor.

Dan - my issue with getting other sessions is that it really isn't "technically" supported, unless you use the Admin SM API, which normally doesn't make sense for most apps. I know there is code out there that uses internal CF objects, but that kind of stuff makes me nervous.

Sorry, correction to a line above. The line should read:

<cfset Session.Person[ListFirst(thiskey,"=")] = ListLast(thiskey,"=")>

We then use the ID that is captured from the cookie and query our database for permission information, though it could be stored in the cookie as well.

For clarification, I named my cookie "Application".

I love CFLOGIN, I stand alone here hehehe if I need anything else from it I usually create a UserSession.cfc

I second OpenID. I first discovered it via 37signals who use it for for Backpack, Basecamp and Highrise. I'm going to be using it for a project in the near future.

@Ryan - yes. I was assuming he was all on one box, or one domain at least.

Eh? You can set cookies for *.foo.com. That way if you have a.foo.com and b.foo.com, the cookies are shared.

Ryan:

If you use CFHTTP hit a remote URL, you can get anything back, including cookies.

If you use CFINVOKE, I'm not 100% sure. There is a getSOAPResponseHeader() method which MAY do it. Worse comes to worse, you can use CFHTTP and parse the WSDL yourself.

I read over my last post and I'm not sure that I made myself clear.

A snip of the App.cfc OnRequestStart function:


<cffunction name="OnRequestStart" returntype="boolean" output="false">
<cfargument name="thePage" type="string" required="true">
<cfif IsDefined("url.logout")>
<cfset structDelete(session, "myapp")>
</cfif>
<cfinclude template="force_login.cfm">
<cfreturn true>
</cffunction>

And now the force_login.cfm page:


<!---If the User is NOT logged in the session variable will not exist, otherwise skip this logical block--->
<cfif not IsDefined("session.myapp.isloggedin")>
<!--- If the user hasn't gotten the login form yet, display it --->
<cfif not (IsDefined("form.login") and IsDefined("form.username") and IsDefined("form.password"))>
<cfinclude template="login.cfm">
<cfabort>
<!--- Otherwise, the user is submitting the login form --->
<cfelse>
<!--- Invoke the Authenticate Function, if returns TRUE then move on --->
<cfinvoke component="myapp.componets.security" method="authenticate" returnvariable="auth">
<cfinvokeargument name="username" value="#form.username#"/>
<cfinvokeargument name="password" value="#form.password#"/>
</cfinvoke>
<!--- If the username and password are correct... --->
<cfif auth>
<cfinvoke component="myapp.componets.security" method="userinfo" returnvariable="info">
<cfinvokeargument name="username" value="#form.username#"/>
</cfinvoke>
<cfset session.myapp.isloggedin = true>
<cfset session.myapp.username = #form.username#>
<cfset session.myapp.role = #info.role#>
<cfset session.myapp.name = #info.name#>
<cfset session.myapp.emailaddress = #info.emailaddress#>
<cfset session.myapp.deptid = #info.deptid#>
<!--- Otherwise, re-prompt for a valid username and password --->
<cfelse>
<cfinclude template="login.cfm">
<cfabort>
</cfif>
</cfif>
</cfif>


Hope that makes sense to you William

So no one here can give an example of setting up a single login to work across multiple applications on multiple servers with differing domains? Using applicationtoken probably wont work across servers, and I know the Master/Sub application setup wont work across servers. Cookie based probably wont work across domains.

There has to be some architecture that can handle that scenario, but so far the closest I saw was the idea to use a <cfhttp> call to hit a web service that returns cookie info...