Over the last nine years, I must have coded at least 100 ColdFusion applications. Many of these contained similar features - calendaring, e-commerce, content management, and dynamic survey forms. Several were "one-offs" - based on work done for previous customers with some modified behavior and rebranding. Others were architected to work in either a dedicated or "Application Service Provider" mode. All of them required an administrative interface with an accompanying security model that required a significant amount of time to reimplement.

Blueprint, from Ivis Technologies, Inc., provides the aforementioned services of application security and localization tools as a single coherent framework. In addition, they provide a slick, "out of the box" GUI (see Figure 1) for the administrative components of your custom software. In many respects, this software successfully provides the security services that CF 5.x "Advanced Security" and certain components of Allaire Spectra failed to deliver on.

Installing Blueprint
Installing Blueprint went reasonably well, relative to other CF-based products that I have tested. The installer not only copied the appropriate files into the proper locations, but it even went so far as to create a new, empty database on my SQL server and proceeded to write out its table schema.

It failed, however, while attempting to use the "sa" account to accomplish this task (using an account other than "sa" worked fine and Ivis later issued a patch). Upon further inspection, however, I found that the product does not make use of Transact-SQL stored procedures - a definite oversight considering that SQL Server is the only database platform currently supported. Also, for a product that concentrates on application-level security, you would think that passwords would be encrypted in the database. Sadly, this is not the case.

Using the Blueprint Administrator
After installation I was able to navigate to the Blueprint administration area and log in. I found their HTML/DHTML user interface to be quite intuitive, and was quickly able to register a new application, create new users and groups, and administer permissions. Blueprint has a very clean interface for modifying user account information, restricting access by IP range (see Figure 2), expiring accounts on a particular date, and logging user actions.

Deploying with a Preexisting CF Application
Integrating Blueprint with my preexisting application was a fairly painless process involving wrapping preexisting sources with a single tag - cfblueprint>.... </cfblueprint>. Their online tutorial was quite helpful in this regard, detailing their preferred naming schema for CF. While using the Ivis methodology to name your files is helpful, it is not required to leverage the security services. Also bundled with the product are examples detailing the ease of deploying Blueprint as a wrapper for preexisting applications using the Fusebox coding style.

Branding and Localization
The second core strength of Blueprint revolves around localization. The product provides comprehensive facilities for dynamically swapping out images and text based on country of origin and/or client login as depicted in Figure 3. In order to facilitate the dynamic manipulation of colors and images, the system comes bundled with additional third-party software - ImageMagick. ImageMagick is implemented as a set of DLL files that are invoked by Blueprint through the use of <CFEXECUTE> tags. This causes me some concern over future platform compatibility and scalability.

(Very) Platform Specific
Perhaps the biggest drawback for Blueprint is platform dependence. Currently, the system will run only on ColdFusion MX/Windows and Microsoft SQL Server. Ivis is readying a new release that will include broader support for operating systems and databases. The lack of support for authentication via Active Directory or LDAP, however, compromises its value as a security framework.

Now that Blueprint can free me from the drudgery of reintegrating or building my own custom application security model, I find that I have moved on to the new frontier of Flash development which, unfortunately, is largely unsupported by their product. For while Blueprint was written specifically for ColdFusion MX, their CFC API layer is currently undocumented, encrypted, and not available to be consumed as Web services through Flash Remoting.

Final Thoughts
Ivis's Blueprint is particularly compelling for CF developers who need to integrate security and/or localization into their CFMX applications, and have not yet established their own code base to supply these services. The product shows promise for essentially being a 1.0 release, and I look forward to reviewing future versions that may contain enhanced functionality, platform support, and broader appeal.

SIDEBAR

Vitals: Blueprint v.1.5
Ivis Technologies, Inc. * 2425 East Camelback * Suite 950 * Phoenix, AZ 85016
Phone: 602-346-5044 * Fax: 602-346-5049 * www.ivis.com

Dell Latitude C640, 512MB RAM 2.2GHz P-4
ColdFusion MX, SP2 * Windows 2000, SP2 *Microsoft SQL Server 2000, SP2
Standard Edition: $795.00 USD (one server, one domain)
Professional Edition: $1995.00 USD (one server, five domains)

Target Audience: Developers looking to add a consistent application-level security and "identity" services to their applications.

Pros: (Relatively) low cost * Easy to use/deploy application security services

Cons: Limited platform support (MX/Win/SQL Server) * No current support for Active Directory * Limited functionality * Initial release (despite v. 1.5 moniker)

Client Platform: Administrative GUI supports Microsoft Internet Explorer only. Server OS: ColdFusion MX/Windows * Database Support: Microsoft SQL Server 7/2000