New CF Dev needs help with security!! 1

[SteelDragon]

I am developing a CF based page that I need to have users log in to, and have different levels of authorzation. I have a database already exisitng with usernames and passwords in it, and I would like to use it as the source location for the login information. I want the users to be authorized to access different pages, or parts of pages only if they meet criteria set in the database in their profile. I need to be pointed in the right direction. I have total control on this project and as such have 100% access to the server if a server config, or solution is required. I would just like to know where I can configure what fields CF can see out of my DB. I already have the ODBC set-up in CF, I just need to know where CF uses this information for security.

 

[CFHub]

You may want to start here.

http://cfhub.com/examples/secure/

 

[CFProgrammer]

You are really tackling a tough task from the start. But hey, no problem. If you are not new intermediate level, then I would suggestiong reading that above article. But it doesn't tell you about anything you want to do. As simple as this, after you are feeling comfortable with login's create another domain(field) in the login table. Name it &quot;role&quot;, I would use type &quot;number&quot; size &quot;byte&quot; that all you need. Now how to apply it? Lets say all admin's have a role of 5, another group of &quot;4&quot;, &quot;3&quot;, etc, etc. After they login, <cfset session.role eq qlogin.role> This will set the session role for who ever login's in. Now on the pages that you want to protect and the links if needed,
<cfif session.role gte 4> show link here</cfif>. Now on the pages you want to protect, let's say you only want admin's accessing a certain page, <cfif session.role neq 5>(if role is not 5) You are not allowed to access this page <cfabort> or <cflocation url=&quot;index.cfm&quot;>.
</cfif>

<cfhappy programming=&quot;OK&quot;>

 

[SteelDragon]

CFProgrammer , I am familiar with what you are saying, is it possible to use a yes/no, on/off value instead of numeric values? Also, Can anyone tell me how CF interfaces with siteminder? Where do you set-up the values and how does SmDsQuery.ini get populated? Any help would be greatly appreciated.
Thanks Again,
SteelDragon