I dont understand the question but, the user enters the username and password, you check that they are both in the database and belong to the same user, if they are you look at the security level and grant the user apropriate access based on their security level.
If they are not in the database you display an error message to the user.