Securing the ColdFusion Administrator

With ColdFusion Server, you can decentralize administrative responsibility by creating multiple administrators. Overall security is maintained because these additional administrators can control only the resources and policies for which you've given them explicit responsibility. You can assign the following types of administrative access to any user:

Administrator Provides complete read and write access to all ColdFusion Administrator pages.
Privileged Provides read and write access to all the ColdFusion pages except the Basic and Advanced Security pages; Privileged users have no access at all to the security pages.
Restricted Provides read and write access only to the Data sources Administrator pages, the Verify Data Source page, and the Verity Collections page; Restricted users have no access to any other ColdFusion Administrator pages. You can configure Restricted access so that a user only has access to specified data sources

You provide different levels of access to the ColdFusion Administrator with a built-in security context called "ColdFusion Admin."

Note

Before you can configure ColdFusion Administrator security, you must know how to create a user directory. If you don't know how to create a user directory, see "Defining User Directories".

To secure the ColdFusion Administrator:

Open the ColdFusion Administrator and click the Advanced Security link.
You see the Advanced Server Security page.
Make sure the Use Advanced Server Security checkbox is selected.
Define a user directory that contains the user to whom you want to assign Administrator privileges. (Leave the username and password fields blank when defining the user directory.)
Under ColdFusion Administration Security, select the Use ColdFusion Administration Authentication check box.
Select the user directory you created in step 3 from the drop-down box.
In the Administrator field, type in the name of a user who is defined in the user directory you selected in step 4. This user will have Administrator privileges for the ColdFusion Administrator.
Click the Apply button at the bottom of the screen.
ColdFusion Administrator security is now enabled. When you close the Administrator and try to open it again, you will be prompted for the username and password of the user you specified in step 5. If you log in as a different user, you will NOT see the Advanced Security link in the Administrator.

Advanced ColdFusion Administration
Configuring Advanced Security