Design Document/Application Plan — NRCS Volunteer Tracker | |||
Project Developer | Keith Stewart | ||
Project Owner | U.S. Department of Agriculture — NRCS | ||
Technical Writer | Keith Stewart | ![]() |
|
Versioning | V 1.0 (18 FEB 2016) | ||
Document Name | DesignDocumentNRCSV1.0.docx |
This design document will serve as the controlling document for the NRCS Volunteer Tracker portal application. This document is also the standardized application plan template describing the primary flow and functionality of the application software. Post project deployment, this document will serve as the Technical Reference for the software application. Hereinafter, throughout this document, the NRCS Volunteer Tracker Software application will be referred to as the NRCSv software.
Key high-level components of this document include the following:
- Application information architecture
- Application functionality
- Application data structure/organization
- Application schedulers
- Application key included library files
The information architectural framework for the NRCSv application is divided into two functional categories consisting of the Application Architecture and the Network Architecture. The application architecture is key to the NRCSv software, therefore greater detail will be provided for the application architecture category. Future Federal Government plans specify that the NRCSv application will migrate to and reside within either a DOI or NPS Cloud network architectural framework. As such, this document describes the “as is” network architecture and specifics relevant to the NRCSv. Future updates to this document will provide details relative to the DOI/NPS Cloud network architecture upon deployment to the Cloud.
The application architecture refers to the type of application processing middleware that processes the NRCSv application as well as the specific design and organization of the information components (core code base) that make up the NRCSv application. The following sections will discuss each of these three application architecture areas.
To process the multiple code components (pages, templates, included files, scripts, database queries, etc.) for this web application, a processing middleware is required. The NRCSv application uses Adobe® ColdFusion™ Standard Version 10 installed on a Windows Server 2008 R2 Enterprise edition software consisting of Dual Core 2.4 Ghz processors on a 64-bit machine. Additionally, the ColdFusion software connects to the Volungeer.gov GSS Microsoft® SQL Server™ 2012 edition database through native and ODBC data connectors (see details in Section 2—Data Structures below). Important note about ColdFusion Version 10 1.
1 The NRCS Volunteer Tracker application uses ColdFusion version 10 for production, however, it was also developed and tested on ColdFusion version 11 Standard Edition. In the event of a ColdFusion upgrade to version 11, the application is expected to perform without issues and without modifications.
The NRCSv application is a collection of multiple ColdFusion templates that perform intended functions as specified in the application design. Templates are considered the core code base for the software application. Each of these templates can be abstracted in terms of a contained set of programming instructions that are executed when the template is accessed by a web browser or when the template is called/requested by another template or an AJAX synchronous scrip call. In general terms, each template involves three main component areas when processing:
IMPORTANT INFORMATION: Key to all ColdFusion applications is the global file which sets application parameters. For the NRCSv application, the global file is the Application.cfm or Application.cfc file. The following KEY application parameters are established in the NRCSv Application.cfm file
Red = Sensitive DO NOT DISCLOSE WITHOUT SYSTEM OWNER PERMISSION
- Component 1: The code Template file with instructions about what function(s) to execute.
- Component 2: The global variables file (Application.cfm) which includes key global application variables, including user authentication.
- Component 3: The included templates and/or other files that provide information and rules to help the Template (Component 1) perform its function(s).

Application Parameter | Value |
---|---|
Application name | VT |
CFToken and CFID | Dynamically set by ColdFusion per session |
Data Source | volunteersql (virtual name, actual DSN set in CF Administrator) |
ErrorEmail | support@volunteer.gov |
todaydate | NOW() Date/Time function to get current server time (EST) |
vDOM(virtual domain) | #cgi.server_name# (CF variable to detect current server) |
vURL (virtual URL) | https://#vDOM#/NRCS |
vFile (virtual file upload location) | #ExpandPath( '../' )# (not currently used for NRCSv) |
REMOVED | REMOVED |
Request Errors | ErrorRequest.cfm |
Exception Errors | ErrorException.cfm |
UA (User Agent) | #cgi.HTTP_USER_AGENT# (CF variable to detect user browser) |
Red = Sensitive DO NOT DISCLOSE WITHOUT SYSTEM OWNER PERMISSION
As is standard in web application software, the core component files (templates, etc.) are organized in logical folder groupings within a web-accessible directory structure on the web server. For the NRCSv application, file structure follows a common organization that is utilized across all Volunteer.gov GSS software applications. Figure #2 and Table #2 detail this core code organization for the NRCSv application.
NOTE: All the code files listed in Figure #2 are physically on the REDACTED server within the REDACTED top-level web directory and the REDACTED second-level web subdirectory. When referring to the NRCSv application, the working directory will be assumed to be the top-level application directory, even though it is contained in the web folders mentioned above.

As of 21 February 2016, the NRCSv software application resides on a DOI/IBC server in the Reston Data Center. For a detailed Network Architecture Diagram, consult the appropriate DOI/IBC Network Operations Administrator. For security, Network Architecture is NOT presented as part of this document. Furthermore, it is anticipated that in 2016, the NRCSv software application will be deployed with the DOI/NPS Cloud framework. Details of the DOI/NPS Cloud framework should be directed to the appropriate DOI/NPS Cloud Network administrator. For the purposes of the NRCSv application, it should be noted that the current DOI/IBC strategy is to force all Network traffic from the IBC Netscaler to the Volunteer.gov server via port 443 so that all traffic is via an encrypted SSL layer. The IBC also manages the SSL Certificate for the Volunteer.gov server where the NRCSv application is hosted.
The following sections provide basic details about the core application logic. This is for the benefit of the support and development teams who are responsible for managing the application. The following sections are listed based on key functional application areas.
Users are authenticated based on their username and password combination. Privileges are assigned based on their user level with National Administrators being the top-level application managers and volunteers being the base level. A brief listing of responsibilities follows:
National Administrators: responsible for managing all volunteers and groups, managing work activities, managing administrators, viewing coordinator emails, managing offices, and also viewing MLRA reports, Year-End reports, and Volunteers with 4000+ hours of accumulated time.
State Administrators: responsible for volunteers and volunteer groups within their respective state (state is designated by their administrator).
Area Administrators: responsible for volunteers and volunteer groups within their respective areas (areas are designated by their administrators).
Office Administrators: responsible for volunteers and volunteer groups within their respective office list (offices lists are designated by their administrator).
Volunteers: responsible for entering their own time, printing/downloading their record of time, and maintaining their own contact information
Group Volunteers: group volunteers do not have access to the system; they are entered by administrators and assigned time.
Based on the above user categories, when a user is authenticated, they are directed to the main portal page based on the following strategy:
All administrative functions are available from the admin page and are restricted based on the user level. Volunteers can only enter time and manage their contact information.
To make the process of user authentication efficient, all application pages (except the home page/login page: index.cfm) include the validateMe.cfm include template. This template checks for the existence of a session variable in the GateKeeper session structure. The GateKeeper session structure parameters are set upon a successful login. The validateMe page runs a check for authentication, if passed, it then sets a CF-Lock (ColdFusion machine lock of multithreading) and converts the GateKeeper session variables to page variables so that a new CF-Lock does not have to be set every time the app requests a GateKeeper variable (VTID, Name, State, User Level, etc.). This allows for the segregation of appropriate access points within the admin page; basically, administrators only see or are allowed to do what their pre-defined user level allows.
If a user is unable to authenticate (after 3 unsuccessful login attempts), they are redirected to the /tossOff subdirectory and a session variable is set which disallows them to login again. This session variable is set for 24 hours but can be reset by closing all browser instances and starting the web browser again. We do NOT disclose this to users, but this functionality is available for support teams as needed.
National Administrators: responsible for managing all volunteers and groups, managing work activities, managing administrators, viewing coordinator emails, managing offices, and also viewing MLRA reports, Year-End reports, and Volunteers with 4000+ hours of accumulated time.
State Administrators: responsible for volunteers and volunteer groups within their respective state (state is designated by their administrator).
Area Administrators: responsible for volunteers and volunteer groups within their respective areas (areas are designated by their administrators).
Office Administrators: responsible for volunteers and volunteer groups within their respective office list (offices lists are designated by their administrator).
Volunteers: responsible for entering their own time, printing/downloading their record of time, and maintaining their own contact information
Group Volunteers: group volunteers do not have access to the system; they are entered by administrators and assigned time.
Based on the above user categories, when a user is authenticated, they are directed to the main portal page based on the following strategy:
User Level | Redirection |
---|---|
Administrators | admin.cfm |
Volunteers | vol.cfm |
All administrative functions are available from the admin page and are restricted based on the user level. Volunteers can only enter time and manage their contact information.
To make the process of user authentication efficient, all application pages (except the home page/login page: index.cfm) include the validateMe.cfm include template. This template checks for the existence of a session variable in the GateKeeper session structure. The GateKeeper session structure parameters are set upon a successful login. The validateMe page runs a check for authentication, if passed, it then sets a CF-Lock (ColdFusion machine lock of multithreading) and converts the GateKeeper session variables to page variables so that a new CF-Lock does not have to be set every time the app requests a GateKeeper variable (VTID, Name, State, User Level, etc.). This allows for the segregation of appropriate access points within the admin page; basically, administrators only see or are allowed to do what their pre-defined user level allows.
If a user is unable to authenticate (after 3 unsuccessful login attempts), they are redirected to the /tossOff subdirectory and a session variable is set which disallows them to login again. This session variable is set for 24 hours but can be reset by closing all browser instances and starting the web browser again. We do NOT disclose this to users, but this functionality is available for support teams as needed.
Reporting is roles-based as determined by a users access level. In most reporting and other administrative functions, the NRCSv application uses asynchronous AJAX calls generally to CFM template files in the /handlers subdirectory to accomplish reporting. Most of these reports are numbered based on the report category being accessed. For example, there are a total of 6 standard reports (configurable with dates and offices and other parameters) which all use AJAX calls to their respective handler file (R01, R02, R03, etc.). There are a total of 8 custom reports which follow the same logic but are more customizable than the standard reports. All reports use AJAX to call their respective handler files (C01, C02, C03, etc.).
Furthermore, each report (standard and custom) includes a feature which allows authenticated users to download the report into an Excel file format. These excel files are created in real-time and are NOT stored on the server. The user is required to either save or open the Excel file on their own client. The Excel files are generated based on the ColdFusion CFDOCUMENT strategy. Most Excel generation files include the naming convention xxx2XLS.cfm in their name structure.
When a user has generated a custom report, they are also able to save their custom report to their “Favorites”. This functionality inserts the report type together with their report variables and parameters to the MyFav table along with the user’s unique VTID. The reports are then accessed by appending the variables to the report type via URL variables.
Furthermore, each report (standard and custom) includes a feature which allows authenticated users to download the report into an Excel file format. These excel files are created in real-time and are NOT stored on the server. The user is required to either save or open the Excel file on their own client. The Excel files are generated based on the ColdFusion CFDOCUMENT strategy. Most Excel generation files include the naming convention xxx2XLS.cfm in their name structure.
When a user has generated a custom report, they are also able to save their custom report to their “Favorites”. This functionality inserts the report type together with their report variables and parameters to the MyFav table along with the user’s unique VTID. The reports are then accessed by appending the variables to the report type via URL variables.
National Administrators are also authorized to perform the following tasks on the NRCSv application:
- Manage Offices: Archive or un-archive offices, add new offices, move offices to other states, change office designations to National/State/MLRA, and edit any address information about offices. Because the NRCS supplies the OIP designation for each office, it is their responsibility to ensure the integrity of OIP numbering. There are no provisions in the application to authenticate OIP numbers and Administrators are prohibited from creating duplicate OIPs.
- Manage Coordinator Email: Manage/Edit/Create email addresses for each State Coordinator.
- View Administrators: View and download to Excel all administrators and access administrators to manage their accounts.
- Manage Work Activities: View/Edit/Create work activities. These work activities will be visible in the time sheet drop down work activity lists for all users. Note: for system integrity, we do not allow for the deletion of work activities. If a work activity is no longer needed, it can be set to NOT visible in the manage work activities area.
- Verify Time: National Administrators can verify or un-verify ANY time entry in the system.
- Manage Groups: Create new groups, manage existing groups, add groups members, and enter group time. The Groups administrative functions are covered in a separate design document available only to administrators. A sample screen of the Groups Time management portal is displayed in Figure #3 below.
The NRCSv application uses several JavaScript files for presentation control and AJAX initiation. These files are located within the /library subdirectory. There is also a sortable.js file which allows for the sorting of a data table based on a user click if the table is tagged with the controlling CSS class (sortable). Section 5 of this document lists the basic function of each JavaScript file and other /library files.
In addition, the home page (index.cfm) of the NRCSv application includes an interactive USA map with the number of total volunteers included for each state. The map is in the /charts subdirectory/. This map is generated from a FusionCharts™ JavaScript component and populated dynamically from a nightly volunteer query (SCHHours.cfm). The data table below the USA map is also generated from this scheduled file (SCHHours.cfm). The controlling FusionCharts scripts and map engine is shared with other applications on Volunteer.gov and is included in the fusioncharts/ folder which is above the top-level NRCSv folder within the REDACTED web server directory. Control of the USA map is via the fusion charts .JS include in the <head> section of the index file.
Additionally, within the Group Time templates (addTime.cfm), there are included FusionChart bar charts indicating the total hours worked for each group per year. Again, these charts are controlled via the FusionChart included JavaScript files located in the <head> section of the admin.cfm
In addition, the home page (index.cfm) of the NRCSv application includes an interactive USA map with the number of total volunteers included for each state. The map is in the /charts subdirectory/. This map is generated from a FusionCharts™ JavaScript component and populated dynamically from a nightly volunteer query (SCHHours.cfm). The data table below the USA map is also generated from this scheduled file (SCHHours.cfm). The controlling FusionCharts scripts and map engine is shared with other applications on Volunteer.gov and is included in the fusioncharts/ folder which is above the top-level NRCSv folder within the REDACTED web server directory. Control of the USA map is via the fusion charts .JS include in the <head> section of the index file.
Additionally, within the Group Time templates (addTime.cfm), there are included FusionChart bar charts indicating the total hours worked for each group per year. Again, these charts are controlled via the FusionChart included JavaScript files located in the <head> section of the admin.cfm
The authentication process on the NRCSv application occurs via a username and password combination authentication process where passwords are encrypted via a SHA 512 HASH and the login form is always processed via port 443 via SSL certificate. The specific process is as follows:
In the form field from the index.cfm page to the nValidate.cfm page, the NRCSv application includes a form field named VGUUID and a value of the unique ColdFusion CFTOKEN value which is generated per user session. The CFTOKEN is encrypted via AES and the stored encryption key (REDACTED variable). When the form is submitted, the nValidate.cfm page then decrypts the VGUUID value and compares it to a generated CFTOKEN. If there is a match, the processing is allowed to proceed. If there is NOT a match, the user agent is then redirected to the sorry.cfm page and processing is stopped. This VGUUID is used as a means of ensuring that the login attempt originated from the index.cfm page on the server. This also prevents cross site scripting and/or hijacking of the login process.
- index.cfm login page (SSL username and Password required)
- validation of username and password in the nValidate.cfm template
In the form field from the index.cfm page to the nValidate.cfm page, the NRCSv application includes a form field named VGUUID and a value of the unique ColdFusion CFTOKEN value which is generated per user session. The CFTOKEN is encrypted via AES and the stored encryption key (REDACTED variable). When the form is submitted, the nValidate.cfm page then decrypts the VGUUID value and compares it to a generated CFTOKEN. If there is a match, the processing is allowed to proceed. If there is NOT a match, the user agent is then redirected to the sorry.cfm page and processing is stopped. This VGUUID is used as a means of ensuring that the login attempt originated from the index.cfm page on the server. This also prevents cross site scripting and/or hijacking of the login process.
The NRCSv application includes a Password Reset function whereby a user can reset their password. The process works as follows:
- On the home page (index.cfm), user clicks the Reset button and follows the instructions
- The user is redirected to the NRCS.cfm reset page. The user must enter their email address or username in the field provided.
- A unique encrypted VGUUID form variable is created (see 2.5 above), and the username entered by the user is passed to the checkReset.cfm template via SSL. If the decrypted VGUUID does not match the CFTOKEN value, the processing is aborted and the user agent is directed to the sorry.cfm page.
- If the username entered matches ONE and ONLY ONE username in the VT_Users table, and a password reset email is generated and sent to the user account email address.
- The temporary password is set in the database with a 2-hour expiration. If the user fails to reset their password within the 2-hour time limit, the user must again request a password reset as above.
- The password reset email includes a temporary password that is encrypted along with instructions for resetting the password.
The NRCSv application is primarily a data-driven software user interface and management tool. Key functionality includes role-based content and user management allocated to two broad categories of users including Federal Government Managers and Non-Federal Government Volunteers. For the NRCSv application, Federal Government Managers are primarily responsible for entering Non-Federal Volunteer time; there is limited Non-Federal Government access to this application.
Within the Federal Managers roles, there are several levels of role-based users and associated functions. Within the Non-Federal Volunteer users, role-based functions are limited to entering time and printing/saving a record of time only. This non-federal volunteer role applies to individuals; specifically, an individual non-federal volunteer can only manage their own time and profile record. Figure # 4 and shows a high-level relationship among the users and primary roles.
Expanding from the Generalized Roles-Based Data Structure (Figure #4), a more detailed relationship view of the roles within the NRCSv application is presented in Figure #5 below (Detailed Roles-Based Functions). These functions are key to designing a manageable and productive database structure.
Based on the primary role-based functionality of the NRCSv application, data structure and data relationships are key to functionality and performance of the application and user interface. The following data structures have been created in the Volunteer.gov database for the NRCSv application:
Within the Federal Managers roles, there are several levels of role-based users and associated functions. Within the Non-Federal Volunteer users, role-based functions are limited to entering time and printing/saving a record of time only. This non-federal volunteer role applies to individuals; specifically, an individual non-federal volunteer can only manage their own time and profile record. Figure # 4 and shows a high-level relationship among the users and primary roles.
Expanding from the Generalized Roles-Based Data Structure (Figure #4), a more detailed relationship view of the roles within the NRCSv application is presented in Figure #5 below (Detailed Roles-Based Functions). These functions are key to designing a manageable and productive database structure.
Based on the primary role-based functionality of the NRCSv application, data structure and data relationships are key to functionality and performance of the application and user interface. The following data structures have been created in the Volunteer.gov database for the NRCSv application:
- Data elements/names
- Data types/length
- Data descriptions
The NRCSv application includes one ColdFusion scheduler task configured in the ColdFusion administrator as follows:
The NRCSv application includes several JavaScript files and associated “helper” files for document formatting and functionality. Table #12 below provides a brief explanation of these files:
Examples of the FusionCharts™ dynamically generated charts and maps are displayed below in Figures #6 and #7 for reference.
Examples of the FusionCharts™ dynamically generated charts and maps are displayed below in Figures #6 and #7 for reference.
The NRCSv app was developed under contract between the USDA NRCS and eSpherical.com, Inc. Contact information for the developer is provided below.
DEVELOPER
eSpherical.com. Inc. (now GraphCube)
Keith Stewart (Chief Developer)
2200 12th Court North, Suite 724
Arlington, VA 22201
support@graphcube.com
eSpherical.com. Inc. (now GraphCube)
Keith Stewart (Chief Developer)
2200 12th Court North, Suite 724
Arlington, VA 22201
support@graphcube.com