ColdFusion Active Directory Authentication

I wrote a custom tag to do authentication against AD (Exchange)... here it is

TO DO: change the parameters for ADserver, ADdomain, usernameX, passwordX to values appropriate for your environment

SYNTAX: <cf_adSecurity username="#theUsername#" password="#thePassword#">

RETURN: you'll get back a structure called userInfo. the most important field for authentication purposes will be userInfo.validUser.



<!---
<fusedoc fuse="adSecurity" language="ColdFusion">
      <responsibilities>
            I am a Custom Tag used to validate a userid/password
            against Active Directory and return back a bunch
            of information in the userinfo structure
      </responsibilities>
      <properties>
            <property name="version" value="1.02"/>
            <history author="Jeff Yokum" date="01/15/2003" type="created"/>
            <history author="Jeff Yokum" date="01/20/2003" type="updated">
                  Added errorCode return value to help determine why a user returned
                  invalid. Was it the credentials or was there a problem talking
                  with ActiveDirectory?
            </history>
            <history author="Jeff Yokum" date="01/22/2003" type="updated">
                  Fixed problem with blank passwords being supplied. If a blank
                  password is supplied to the cfldap tag, it returns an empty
                  recordset instead of throwing an error.
            </history>
      </properties>
      <io>
            <in>
                  <string name="username" scope="attributes"/>
                  <string name="password" scope="attributes"/>
                  <string name="ADserver" scope="attributes" default="myServerName" optional/>
                  <string name="ADdomain" scope="attributes" default="myDomainName.com" optional/>
                  <string name="ADstart" scope="attributes" default="DC=com,DC=myDomainName" optional/>
                  <string name="usernameX" scope="attributes" default="backupUsername" optional comments="If you need to override the username for secondary validation"/>
                  <string name="passwordX" scope="attributes" default="backupPassword" optional comments="If you need to override the password for secondary validation"/>
            </in>
            <out>
                  <structure name="userinfo" scope="caller">
                        <string name="validUser" comments="0=Invalid; 1=Valid" />
                        <string name="errorCode" comments="0=None; 1=Invalid User/Password; 2=ActiveDirectory problem"
                        <string name="firstName" comments="" />
                        <string name="middleInit" comments="" />
                        <string name="lastName" comments="" />
                        <string name="address" comments="" />
                        <string name="city" comments="" />
                        <string name="state" comments="" />
                        <string name="zip" comments="" />
                        <string name="email" comments="" />
                        <string name="phone" comments="" />
                        <string name="pager" comments="" />
                        <string name="mobile" comments="" />
                        <string name="fax" comments="" />
                        <string name="memberOf" comments="" />
                        <string name="dn" comments="" />
                        <string name="UAC" comments="userAccountControl" />
                  </structure>
            </out>
      </io>
</fusedoc>
 --->

<cfif isdefined("thistag") and thistag.executionmode eq "start">
 
<cfparam name="attributes.username" default="">
<cfparam name="attributes.password" default="">
<cfparam name="attributes.usernameX" default="backupUsername">
<cfparam name="attributes.passwordX" default="backupPassword">
<cfparam name="attributes.ADserver" default="myServerName">
<cfparam name="attributes.ADdomain" default="myDomainName.com">
<cfparam name="attributes.ADstart" default="">

<cfscript>
      userinfo=structnew();
      userinfo.validUser    = 0;
      userinfo.errorCode    = 0;
      userinfo.firstName    = "";
      userinfo.middleInit   = "";
      userinfo.lastName     = "";
      userinfo.address      = "";
      userinfo.city         = "";
      userinfo.state        = "";
      userinfo.zip          = "";
      userinfo.email        = "";
      userinfo.phone        = "";
      userinfo.pager        = "";
      userinfo.mobile       = "";
      userinfo.fax          = "";
      userinfo.memberOf     = "";
      userinfo.dn           = "";
      userinfo.UAC              = "";
</cfscript>

<!---
 Parse ADdomain into an appropriate LDAP start string
--->
<cfif attributes.ADstart eq "">
      <cfloop list="#attributes.ADdomain#" delimiters="." index="DC">
            <cfset attributes.ADstart = attributes.ADstart & "DC=" & #DC# & ",">
      </cfloop>
      <cfset attributes.ADstart = left(attributes.ADstart,len(attributes.ADstart)-1)>
</cfif>

<cftry>
      <!---
       Query AD with the supplied username/password combination. If this returns
       data, we know the credentials were valid.
      --->
      <cfldap
            server="#attributes.ADserver#.#attributes.ADdomain#"
            action="QUERY"
            name="qryADdata"
            start="#attributes.ADstart#"
            attributes="givenname,initials,sn,streetAddress,l,st,postalCode,telephonenumber,pager,mobile,facsimileTelephoneNumber,mail,memberOf,dn,userAccountControl"
            filter="(&(objectClass=user)(sAMAccountName=#attributes.username#))"
            scope="SUBTREE"
            port="389"
            username="#attributes.username#@#attributes.ADdomain#"
            password="#attributes.password#"
            rebind="Yes"
      >
      
      <!---
       If a username was supplied but a password was NOT supplied, the cfldap tag
       will return an empty recordset. We have to check to see if there is actually
       any data being returned. recordcount is good for this. If there are any
       records, the user is valid, otherwise throw an error so our error routine
       kicks in.
      --->
      <cfif qryADdata.recordcount gt 0>
            <cfset userinfo.validUser=1> <!--- set the validUser flag to true --->
      <cfelse>
            <cfthrow type="AD"> <!--- throw an error --->
      </cfif>
      
      <cfcatch type="Any">
            <cftry>
                  <!---
                   If we get here, either the supplied credentials are invalid or there
                   was a problem querying Active Directory. Let's try querying AD with a
                   known, supposedly valid, username/password. If this returns data,
                   we assume the supplied username/password combination was invalid.
                   If it fails, we assume there was a problem communicating with
                   Active Directory.
                  --->
                  <cfldap
                        server="#attributes.ADserver#.#attributes.ADdomain#"
                        action="QUERY"
                        name="qryADdata"
                        start="#attributes.ADstart#"
                        attributes="givenname,initials,sn,streetAddress,l,st,postalCode,telephonenumber,pager,mobile,facsimileTelephoneNumber,mail,memberOf,dn"
                        filter="(&(objectClass=user)(sAMAccountName=#attributes.username#))"
                        scope="SUBTREE"
                        port="389"
                        username="#attributes.usernameX#@#attributes.ADdomain#"
                        password="#attributes.passwordX#"
                        rebind="Yes"
                  >
                  <cfset userinfo.errorCode=1> <!--- errorCode set to 1 indicating a successful hit on AD --->
                  <cfcatch type="Any">
                        <!---
                         If we get here, both the initial credential check failed and the
                         followup check failed. We're assuming that usernameX/passwordX
                         from the followup check are truely valid but the query still failed.
                         There must have been a problem talking to the Active Directory server.
                        --->
                        <cfset userinfo.errorCode=2> <!--- errorCode set to 2 indicating a problem communicating with AD --->
                        <cfset userinfo.dump = cfcatch>
                  </cfcatch>
            </cftry>
            <cfset userinfo.validUser=0> <!--- regardless of the errorCode, the validUser flag is set to false --->
      </cfcatch>
</cftry>

<cfif isdefined("qryADdata") and userinfo.validUser>
      <!---
       Cleanup the returned data and populate the userinfo structure
      --->
      <cfscript>
            userinfo.firstName    = qryADdata.givenname;
            userinfo.middleInit   = qryADdata.initials;
            userinfo.lastName     = qryADdata.sn;
            userinfo.address      = qryADdata.streetAddress;
            userinfo.city         = qryADdata.l;
            userinfo.state        = qryADdata.st;
            userinfo.zip          = qryADdata.postalCode;
            userinfo.email        = qryADdata.mail;
            userinfo.phone        = qryADdata.telephoneNumber;
            userinfo.pager        = qryADdata.pager;
            userinfo.mobile       = qryADdata.mobile;
            userinfo.fax          = qryADdata.facsimileTelephoneNumber;
            userinfo.dn           = qryADdata.dn;
            userinfo.UAC              = qryADdata.userAccountControl;
      </cfscript>
      
      <cfloop list="#qryADdata.memberOf#" index="x" delimiters=",">
            <cfset element = listtoarray(x,"=")>
            <cfif trim(element[1]) eq "CN">
                  <cfset userinfo.memberOf = listappend(userinfo.memberOf,element[2],"|")>
            </cfif>
      </cfloop>
</cfif>

<cfset caller.userinfo = userinfo> <!--- return data to the caller --->
</cfif> <!--- End CustomTag if statement --->