Setting up Security Roles in ColdBox

Fake Jake is back. He wants to secure some of his events based on 'roles' within ColdBox. ColdBox has security baked in with it's core security interceptor, so this should be easy....

ColdBox 3 (I am using M6 version) gives us a .cfc based config file, and this is where I will be declare the security interceptor.

view plain print about
1//Interceptors
2interceptors = [
3 //security
4 {class="coldbox.system.interceptors.security",
5 properties={rulesSource="xml",
6 rulesFile="/config/securityRules.xml.cfm",
7 debugMode="false",
8 preEventSecurity="true"}}    
9    ];

From the above you can see I have told the interceptor where to find my security rules. In this example I have placed my security rules in an xml file called 'securityRules.xml.cfm'. But these rules could also be pulled from a database, model and ORM etc.

Now lets have a look at the rules in this file...

view plain print about
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!--Security rule
3ex: All events in the user handler
4 user\..*
5ex: All events
6 .*
7ex: All events that start with admin
8 ^admin
9If you are not using regular expression,
10just write the text
11that can be found in an event.-->
12
13<rules>
14 <rule>
15 <whitelist>
16 general\..*,
17    login\..*
18 </whitelist>
19 <securelist>
20 dashboard\..*
21 </securelist>
22 <roles>user,admin</roles>
23 <permissions>read,write</permissions>
24 <redirect>login.index</redirect>
25 </rule>
26</rules>

As you can see we have a 'whitelist' of events that will not be verified by the security interceptor. We also have a 'securelist'. In my example this means that any event starting 'dashboard' will be secured and redirected to 'redirect' rule, in this case it's the event login.index.

Roles in my case mean that only users with the role assigned of 'user' or 'admin' will be allowed to visit the secure list of events.

That's it! We have setup our role based security in ColdBox. Now lets look at a simple login event. This event fires after the user has clicked login and it's where I will be validating their login credentials.

view plain print about
1/* validate login credentials */    
2function validateCredentials(any){
3    var rc = event.getCollection();
4    var userBean = "";
5    userBean = userService.new();//new object
6    populateModel(userBean);//populate object from scope
7    userCount = userService.countWhere(entityName="user",
8 user_name="#userBean.getuser_name()#",
9    user_password="#userBean.getuser_password()#");
10        
11    if (userCount eq 1){//correct login
12    userBean = userService.findUser();
13    userService.save(userBean);//update user login details
14    loginUser(username=userBean.getuser_name(),
15 password=userBean.getuser_password(),
16 role=userBean.getuser_role());
17    return true;            
18}
19    else {
20return false;
21}
22    }

Because I am using CFScript for my components you can see that I have to call another function called 'loginUser'. loginUser is just inside a none script based CFC that I call by extending this component. for example....

view plain print about
1<cffunction name="loginUser" returntype="void" output="false">
2<cfargument name="username" required="true">
3<cfargument name="password" required="true">
4<cfargument name="role" required="true">
5<!--- log the user in --->
6    <cflogin
7    idletimeout = "1800">
8
9     <cfloginuser
10     name = "arguments.name"
11 password = "arguments.password"
12     roles = "arguments.role">
13    </cflogin>
14
15</cffunction>

The reason for this is that CF9 does not have a script version of login.

That's really it, I have now secured my events based on user roles. For more reading visit the ColdBox Doc's

Oct06

Post Info

Simple create in ColdBox using ORM CF9

In my last post I showed you how to set-up ColdBox with ORM. I also showed you how to use your service layer within your handlers. Today, an example of how to create a new record in ColdBox using ORM.

Let's use a real pretend example for this. Fake Jake has the following issue he wishes to address.

Jake wants to create a simple sign-up form on his website. He is already using Coldbox M6 and wants to use ORM to create a database with user information and populate it with a simple sign-up form. He has already followed the example post on how to set-up ORM within CB.

Well Jake, first you will need to create the Domain Object for the user sign-up. Nothing complicated about this only a few fields will be needed. However, I have reminded Jake to set-up the event handler correctly within in his Application.cfc. This is done by adding the ORMEventHandler.cfc to the model folder and making sure this 'eventhandler' attribute is 'ORMEventHandler.cfc'

Continue Reading

Oct03

Post Info

ColdBox sites that have gone live.

A few new Coldbox powered sites pushed live of this month.

EntryMaster. A sports registration gateway for the UK market using ColdBox to power a custom CMS and payment system.

Zurich, but you need to login to access via SimplyBiz.

Whats Next

Coming next month MonsterHunt.co.uk. A AR game powered by ColdBox. Lots of press for this one leading up to Halloween so watch this space, its going to be cool! The Zombies are coming!


Sep02

Post Info

My First ColdBox ORM Setup

As promised I will be posting on my own experiences in setting up CF9's inbuilt ORM with ColdBox. Most of this will be for my own reference.

For this example I am using the M6 release of ColdBox so some of this may change by the final release.

Right, let's start.

First like a normal CF9 ORM project you have to tell your application you are using ORM. ColdBox has it's own set of tools which help integrate hibernate. The first is a must if you're going to use hibernate within CB, and that's the event handler! I would suggest reading up on the ORM event handler as it does a lot more and shows you how to setup Autowire to inject objects into your entities etc.

view plain print about
1// ORM Setup
2    this.ormEnabled = true;
3    this.datasource = "myDS";
4    this.ormSettings = {
5        dbcreate = "update",
6        dialect = "MicrosoftSQLServer",//Specifies the dialect.
7        logSQL = true,
8        eventhandling = true,
9        eventhandler = "model.ORMEventHandler",
10        flushAtRequestEnd = false
11    };

As you can see you have added eventhandling = true, and eventhandler = "model.ORMEventHandler" to the code above. You will now need to add the ORMEventHandler.cfc to your model folder (providing you are following the same folder structure of course).

Next I am going to setup my first Domain Object. Depending on how your using it you will need to create this in the same model folder.

For this example we will setup a simple object and I will assume you already have some understanding of this.

Continue Reading

Aug31

Post Info

Dear ColdBox

It's been hard for me to get my head around CF9 ORM and ColdBox. The first mistake was using ORM within ColdBox for the first time. My life would have been easy if I had just started at the beginning with ORM. Why did I do it! Why!

Anyhow, I am committed! Truly, exciting and frustrated at the same time. The ColdBox support group is really helpful and if I may say incredibly patient at helping me with my stupid questions!

Over the next few weeks I am going to write up my own experiences with ORM and set up a demo using the M6 version of ColdBox. It won't be from an authority point of view, but from a beginners venture into ORM. In the mean time I want to just remind people of a post Luis made about community and support.

Post Here

Luis gives back so much with this Framework it's made my life a lot easier, if it's helped you, then why not do your bit to.

Aug29

Post Info

ColdBox M5 and 2.6.4 Playing Together Continued

This morning I had sometime on my hands to revisit how I had setup ColdBox M5 using refactoring. Following a comment by Jason Dean, who suggested it would be much easier to use application specific mappings with CF8+. So I decided to give it another ago.

When I first tried this I got an error due to Application.cfc extending the framework. As another comment pointed out ColdBox apparently since version 2.6 comes with a no inheritance version that instead of extending the framework bootstraps it. This would allow me declare my mapping before the framework is initialised.

view plain print about
1<cfset this.mappings[ "/coldbox" ] = expandPath( "/coldbox" ) />

This is why I love the medium I choose to express myself in and the CF community, because they are so helpful.

May02

Post Info

ColdBox M5 and 2.6.4 Playing Together

To do this without refactoring see: http://www.cfcoffee.co.uk/index.cfm/2010/5/2/ColdBox-M5-and-264-Playing-Together-Continued

Have you downloaded the lasted update from Luis, ColdBox M5? No? Well you should download it right now! So many new goodies, however running CB release M5 alongside my stable version CB 2.6.4 took me a while to set-up in my environment. I have been playing with the new update for a week, but only locally. Now I wanted to actually do something I would need to run it in an environment with an older version.

I run IIS6 and have CB 2.6.4 mapped in my ColdFusion Administrator. Any reference to coldbox/system will use this release. I wanted to run both versions so that my old applications running 2.6.4 still work!

As I found out this can be done very easily following ColdBox Refactoring Guide found here and the Ant Script found in the download. I had a few issues with this tho, not many but here is what I did....

Your set-up many differ from this, this is just my experience!

I Downloaded M5 from the the ColdBox site and placed it on my desktop following the instructions in the refactoring guide. I used ColdFusion Builder to run the Ant script not Eclipse but it's the same.

My default path for my CFC's is coldbox.system, this is mapped in my ColdFusion Administrator to shared/frameworks/coldbox/system. Because my new version is going to run inside the same 'framework' folder I entered not the full path to the new location as the guide shows but the Logical Path. This is my case would be coldbox3.system.

Continue Reading

Apr30

Post Info

ColdBox Brings Modules in 3.0!

Coldbox 3.0 will have Modules! This is actually a big thing in the world of CB! It opens up a whole new set of possibilities for the application we are developing at work. Extensibility with self-contained modules. Read more here

Apr04

Post Info

BBC News Feedback on the ColdBox Application by Gencia Media

The feedback and press have started to come in for the She Says, She Says campaign created by Gencia Media which used ColdFuson and the framework ColdBox to power a mobile application to help awareness of teen sexual violence and rape. Read the full article on the BBC here

Mar29

Post Info

ColdBox Helps Government Rape Awareness Campaign

The start of several Government projects including a mobile application that helps teenagers become more aware of what constitutes as rape and how to get support was launched today. The applications both mobile and web needed a fast and reliable approach. After a short debate the development team including myself decided to use the ColdBox Framework by Luis Majano along with jQTouch (A jQuery plugin for mobile web development) we first heard about on a CF Podcast (CFHour).

The first campaign is using a version of Gencia's new survey based system written with the ColdBox framework. It's designed for Schools allowing them to create both mobile and web campaigns which then local authorities get live statistical data on how each area is doing including detailed analyse of changes in patterns of behaviour.

Continue Reading

Mar23

Post Info

More Entries