Cold Fusion, IIS and Windows Authentication

[Michael London]

Hello all, we have a very bizarre situation that I hope someone here
might be able to shed some light on.

Recently one of our Development servers failed and we are in the process
of rebuilding it. It is running Windows 2000 Advanced Server, IIS and
ColdFusion 6.1. Additionally, we want to establish Windows
Authentication via IIS on the server itself, so when a developer (or
anyone for that matter) tries to connect to it via the internet, they
have to domain authenticate.

Here's the problem(s):
1) When we installed ColdFusion and tried the Windows Authentication
setting in IIS, the server would not allow anyone (EXCEPT the domain
account it was logged on as) to launch ColdFusion Pages.
2) When we turned off the Windows Authentication, it does not launch
ColdFusion Pages, again except for the account the server is logged on as.

IIS will, however, prompt for authentication and launch HTML pages just
fine....it is only when we try to fire up a ColdFusion page that it
begins failing. I have talked to another system admin friend and he
suspects (as do I) that it is a permissions problem either with the
account ColdFusion is running under or with the Directory/Files trying
to be accessed.

I am happy to provide more details as needed but I am not the server
admin and am learning this as I go, so please bear with me =)

Mike

[JonathanBigelow]

Sounds like an NTFS problem to me.

Here's the portion of a server build guide that I wrote that relates to NTFS
permissions:

Set NTFS Permissions

Set permissions at the root of all drives to Administrators (FC), System(FC)
(set permissions, click Advanced and choose ?Reset permissions on all child
objects and enable propagation of inheritable permissions?.)For C:\Program
Files\Common Files add Anon. Web Users and svc_ColdFusion and grant Read &
Execute, List Folder Contents and Read permissions.In C:\WINNT\System32 select
all folders except for Inetserv and Certserv. Open properties and clear the
?Allow inheritable permissions from parent to propagate to this object?
checkbox.In C:\WINNT select all folders except Downloaded Program Files, Help,
IIS Temporary Compressed Files, Offline Web Pages, System32, Tasks, Temp, and
Web. Open properties and clear the ?Allow inheritable permissions from parent
to propagate to this object? checkbox.For C:\WINNT add Anon. Web Users and
svc_ColdFusion and grant Read & Execute, List Folder Contents and Read
permissions.For C:\WINNT\Temp select Anon. Web Users and svc_ColdFusion and
grant Modify permissions.For C:\CFusion add svc_ColdFusion and grant Modify
permissionsFor C:\CFusionMX\bin, add Anon. Web Users and grant Read & Execute,
List Folder Contents and Read permissions.For C:\CFusionMX\runtime\lib\wsconfig
add Anon. Web Users and grant read permissions, specifically deny write
permissions.For E:\Inetpub, add svc_ColdFusion and grant modify permissionsFor
E:\Inetpub\iagent add Anon. Web Users and grant Read & Execute permissions,
specifically deny write permissions.Specifically deny read and write
permissions to the following files for Anon. Web Users and Web Applications:

at.execmd.execscript.exedebug.exeedlin.exeftp.exei isreset.exeiissync.exenbtstat.
exenet.exenetsh.exepoledit.exeregedit.exeregedt32. exeregsvr32.exerexec.exerunas.
exerunonce.exeScrrun.dlltelnet.exetftp.exetskill.e xexcopy.exewscript.exe

[JonathanBigelow]

Another INVALUABLE tool for troubleshooting NTFS permissions is FileMon from
SysInternals ([url]http://www.sysinternals.com/ntw2k/source/filemon.shtml[/url]). You can
run FileMon on your server, execute a ColdFusion page and look for any "Access
Denied" errors. It'll tell you which files the service is needs to access but
can't.

[JonathanBigelow]

Side Note:

Macromedia...err...Adobe...err...CF Team, it's time to implement a real
WYSIWYG editor for the forums. That freaking quazi-pseudo-HTML code is a pain
in the ###. How about FCKEditor ([url]http://sourceforge.net/projects/fckeditor/)?[/url]

[Michael London]

JonathanBigelow wrote:

> Side Note:
>
> Macromedia...err...Adobe...err...CF Team, it's time to implement a real
> WYSIWYG editor for the forums. That freaking quazi-pseudo-HTML code is a pain
> in the ###. How about FCKEditor ([url]http://sourceforge.net/projects/fckeditor/)?[/url]
>

THANK YOU! I will check these out!

Mike