Webmaster Forum / ColdFusion / Advanced Techniques / October 2007

My first attempt at putting in your code resulted in locking myself out
completely.  My second attempt just doesn't lock at all.  I'm thinking I have
the items in the wrong place in the files or in the wrong files altogether.
[hr]
[b]Ok, in my mm_wizard_login.cfm file I have:[/b]

<cfinclude template="Application.cfm">
<cfinclude template="Application.cfc">

<cfparam name="errorMessage" default="">

<!--- output error message if it has been defined --->
<CFPARAM NAME="session.loginCount" DEFAULT="0">
<CFIF session.loginCount IS 3>
   You have failed on 3 login attempts.  Come back later.
   <CFABORT>
</CFIF>

<cfif len(trim(errorMessage))>
    <cfoutput>
    [BULLET]
        [LI]<font color="FF0000">#errorMessage#</font></li>
    [/BULLET]
    </cfoutput>
</cfif>

<!--- This is the login form, you can change the font and color etc but please
keep the username and password input names the same --->
<cfoutput>
<H2>Please Login to the Staff Awards Database.</H2>

   <cfform  name="loginform" action="#CGI.script_name#?#CGI.query_string#"
method="Post">
      <table>
         <tr>
            <td>User Name:</td>
            <td><cfinput type="text" name="j_username" required="yes"
message="A username is required"></td>
         </tr>
         <tr>
            <td>Password:</td>
            <td><cfinput type="password" name="j_password" required="yes"
message="A password is required"></td>
         </tr>       
          </table>
      <br>
      <input type="submit" value="Log In">
   </cfform>
</cfoutput>
[hr]
[b]and then in my mm_wizard_authenticate.cfc file I have:[/b]

<!---- ////////////////////////////////////////////////////--->
     <!---- Simple Authtentication                                --->
     <!---- ////////////////////////////////////////////////////--->

       <cffunction name="simpleauth" access="private" output="false"
returntype="struct" hint="Authenticate using a single username and password">
        <cfargument name="sUserName" required="true" hint="The username that was
setup in the Login Wizard.">
        <cfargument name="sPassword" required="true" hint="The password that was
setup in the Login Wizard.">
        <cfargument name="uUserName" required="true" hint="The username passed in
from the client.">
        <cfargument name="uPassword" required="true" hint="The password passed in
from the client.">
        <cfset var retargs = StructNew()>
       
        <cfif sUserName eq uUserName AND sPassword eq uPassword>
            <cfset retargs.authenticated="YES">
         <cfelse>
            <cfset retargs.authenticated="NO">
         </cfif>

         <cfreturn retargs>
     </cffunction>
   
     
       <!---- ////////////////////////////////////////////////////--->
     <!--- This method performs the <cflogin> call and in turn  --->
     <!--- calls the actual authentication method               --->
     <!---- ////////////////////////////////////////////////////--->
     <cffunction name="performlogin" access="public" output="true" hint="Log a
user in using either NT, LDAP, or Simple(a predifined username and password)
authentication.">
         <cfargument name="args" type="struct" required="true" hint="These are the
parameters setup by the Login Wizard">
            <cfset var x = "BA96585C95784E12FFEBDD0117FCAEBD">
             <cfset var y = "6B3163D122DE19B5DCC2DEBDF70CAED5">
       <cflogin>
        <cfif NOT IsDefined("cflogin")>
            <cfif args.authLogin eq "challenge">
                <cfheader statuscode="401">
                <cfheader name="www-Authenticate" value="Basic realm=""MM Wizard
#args.authtype# Authentication""">
            <cfelse>
                 <cfinclude template="#args.loginform#">
             </cfif>
             <cfabort>
        <cfelse>
              <cftry>
              <cfif args.authtype eq "NT">
                <cfinvoke method="ntauth"
                    returnvariable="result"
                    nusername="#cflogin.name#"
                    npassword="#cflogin.password#"
                    ndomain="#args.domain#" >

                    <cfelseif args.authtype eq "LDAP">
                        <cfinvoke method="ldapauth" returnvariable="result"
                          lStart="#args.start#"
                          lServer="#args.server#"
                          lPort="#args.port#"
                          sUserName="#args.suser#"
                          sPassword="#args.spwd#"
                          sQueryString="#args.queryString#"
                          uUsername="#cflogin.name#"
                          uPassword="#cflogin.password#">                   
                        </cfinvoke>
                    <cfelseif args.authtype eq "Simple">
                        <cfinvoke method="simpleauth" returnvariable="result"
                            sUserName="#args.suser#"
                            sPassword="#args.spwd#"                                          
                            uUserName="#cflogin.name#"
                            uPassword="#hash(x&cflogin.password&y,'SHA-1')#">
                        </cfinvoke>
                    </cfif>       
                   

           
                <cfcatch>
                    <cfset errorMessage = "Your login information is not valid.<br>Please Try
again.<br>If you have tried three times unsuccessfully you have been locked
out.  You may try again after 20 minutes.">
               
                <cfif args.authLogin eq "challenge">
                    <cfheader statuscode="401">
                    <cfheader name="www-Authenticate" value="Basic realm=""MM Wizard
#args.authtype# Authentication""">
                <cfelse>
                     <cfinclude template="#args.loginform#">
                 </cfif>
                    <cfabort>                               
                </cfcatch>                   
                </cftry>
            </cfif>
                <!--- validate if the user is authenticated --->
              <cfif result.authenticated eq "YES">
                          <!--- if authenticated --->
                        <cfloginuser name="#cflogin.name#" password="#cflogin.password#"
roles="user">
                    <cfelse>
                        <!--- if not authenticated, return to login form with an error message
--->
                                               
                        <cfset errorMessage = "Your login information is not valid.<br>Please
Try again.<br>If you have tried three times unsuccessfully you have been locked
out.  You may try again after 20 minutes.">
                       
                        <CFSET session.loginCount = session.loginCount + 1>
<CFLOCATION URL="mm_wizard_login.cfm">
                                           
                <cfif args.authLogin eq "challenge">
                    <cfheader statuscode="401">
                    <cfheader name="www-Authenticate" value="Basic realm=""MM Wizard
#args.authtype# Authentication""">
                <cfelse>
                     <cfinclude template="#args.loginform#">
                 </cfif>
                    <cfabort>                       
                  </cfif>
         </cflogin>

     </cffunction>