Roles

[Don Smith]

I am having an issue with using Roles to grant access to certain
pages. I'm hoping to specify multiple roles as having access to a
page, e.g. roles="Site Admin,Seller Admin,Seller". So a user with any
of those roles should have access to this page.

My Application.cfc page attribute is like this:
<page title="Manage Page" template="Page_Manager.cfm" roles="Site
Admin,Seller Admin,Seller">

And my user has one Role of Seller. At this point they cannot access
this page.

I swap the Role of my user from Seller to Admin, but they still don't
have access to the page.

Then I give my user all three roles and then they get access to the
page. So it looks like the roles attribute of page is looking to match
exactly the Authenticated User Roles.

I don't think this is the intended behavior. Should I do something
different with roles, or is thing a bug?

Thanks,

Don

[Don Smith]

Update: I've noticed that if the role attribute for a page has just
one role, but the user has multiple roles, one of which matches, then
the user is granted access. I think this makes good sense. I was
looking for a list comparison that checked for a match for any
element, but this is probably close enough.

Thanks!