Am attempting to upgrade to ColdFusion 10 (patched to current level) on our development network. We are running Windows Server 2008 R2. On both of the below instances it worked fine with ColdFusion 8 and 9.
On the first instance the entire site is SSL with the exception of one directory. The entire site is set to Anonymous Authentication Disabled and Windows Authentication Enabled for the entire site except for the one directory that is not SSL. On ColdFusion 10, that one directory that is not supposed to be SSL and have anonymous authentication will not allow access unless you hit it with an https: and authenticate. It ignores the settings for that directory and uses the overall site settings.
On another instance the entire site is set to Anonymous Authentication except one file (login.cfm) is set to Windows Authentication. When you enter that site it hits the login.cfm, if you authenticate it gives you more options. If you don't you still get in but without the extra options. The system ignores the Windows Authentication and defaults to the overall site's setting of Anonymous Authentication. I have tried setting the authentication at the site level to both Anonymous and Windows then going through individual directories and changing them to what they should be, but the settings are ignored and it uses the overall site settings.
Is Tomcat somehow overriding the page/folder specific SSL and or Authentication settings?