How does the ColdFusion service interact with IIS in terms of security?
CF runs as a separate service, but it also integrates with IIS using an ISAPI extension. The ISAPI extension runs in-process with IIS, just like the ASP engine, and when a request is received that is mapped to the file extension associated with the ISAPI extension (typically .cfm and .dbm, although those can be changed in the IIS management console), the request is forwarded to the CF service for processing. IIS and NT security are used to determine whether the user can request the file in the first place. This happens before the request is forwarded to the CF service. So, you’ll generally follow the same procedure for securing CF applications with ACLs that you would with an ASP application. CF, by default, runs as a service using SYSTEM privileges.
