Sorry, should have mentioned that I am using COM iBO's.

I think you're pretty much right, except that DBID is their ID from the Name table and UserID is their login name, whatever it is.

I am pretty sure that DBID is the dsn for the database.
If UserID is the login name, then what is UserName?
What is ContactID?

Here is my code so far:

// starting iBO's
$ibo_oUser = new COM("iboUserSecurity.CUser") or die("Unable to instantiate iboUserSecurity");
$ibo_oUser->DBID = "ODBC:iMISLive";

//validate user
//information from the Name_Security table
$ibo_oUser->UserID = "16611";
$ibo_oUser->UserName = "aaronf";
$ibo_oUser->ContactID = "aaronf";
$ibo_oUser->Password = "mycleartextpassword";
$ibo_oUser->Validate();

echo "Validated?: " . $ibo_oUser->Validate(); //This does not return with anything (True or False).

//free the objects
$ibo_oUser = null;

I am sure I am missing something simple!

CUser.Validate doesn't return a value; you need to check the CUser.Errors collection after you call it in order to see if the user was validated. (If CUser.Errors.Count = 0, it was successful; otherwise, you can use it to get the exact error messages(s).)

Many thanks for your help Eric, I knew it had to be something simple!