# Creating an Advanced Security Framework

No matter which Advanced Security feature you choose to implement -- user security, RDS security, a security sandbox, or administrator security -- you'll follow the same basic steps for creating the framework:

1. Set up the security server. See "Setting Up a Security Server" for more information.
2. Set up user directories to authenticate against an NT domain, an LDAP directory, or an ODBC data source. See "Defining User Directories" for more information.
3. Create a security context for the application. See "Defining a Security Context" for more information.
4. Specify individual resources to protect and set up policies that match secured resources with authorized users and groups.. See "Specifying Resources to Protect" for more information.

The rest of this chapter teaches you how to configure Advanced security on the ColdFusion server.

## Implementation summary

The details of your ColdFusion Server Advanced Security implementation depend largely on your platform and how you decide to store security profile information. Security profile information can be stored in one of three ways:

- Using the Access database file supplied by default with ColdFusion Server (Windows only)
- Using the ODBC data source of your choice
- Using an LDAP directory server, such as the Netscape Directory Server supplied with ColdFusion Server. LDAP is the only option on UNIX.

Once you have decided on a method of storing security profile information, the implementation details are essentially the same regardless of platform and storage type. ColdFusion Advanced Security is implemented by defining the following elements in order:

1. A security server.
2. A security context.
3. A user directory, in the form of an NT domain, an LDAP directory, or an ODBC data source.
4. Specific ColdFusion resources to protect.
5. Users and groups who will have access to the resources.
6. Policies that group users and resources together into logical elements.