There are two parts to your application: a Web-based customer-facing front end and a back end directory service or data store with authenticated users. The authentication feature in .NET needs both pieces. Since a user directory is required, no matter what you do, the issue isn't just about only relying on the .NET membership classes on the front end. It's also about the directory services, and connecting to them on the back end.
Here's a quick overview of authentication in .NET with some options to consider.
On the Web side, ASP .NET 2.0 provides ready-made code for creating log-in pages and server controls. Prior versions of ASP .NET didn't have this feature, and log-in pages for new Web applications had to be coded from scratch.
On the directory side, there are two built-in membership classes for connecting to Active Directory (AD) or SQL Server, which is no surprise since both are also Microsoft products just like .NET itself. The two classes, ActiveDirectoryMembershipProvider and SqlMembershipProvider, work with a configuration file called Web.config.
But, if you want to use some other directory service, a custom provider can be created by deriving from the MembershpProvider abstract class and tweaking the Web.config file.
Either way, these provider classes manage all the heavy lifting for connecting to the directory services, whether they're Microsoft or not. They are used for adding and deleting users, modifying users and their groups and other access management tasks, such as changing passwords.
The question isn't whether the .NET authentication framework is secure enough; it's how secure is the back-end directory service, which is what drives the application. Since .NET is compatible with its sister Microsoft product, AD, it would probably make the most sense to stick with that.
If flexibility is an issue, there are many options that allow access to multiple directory services for the same application. The details, however, are beyond the scope of this brief answer. Code and instructions are available on Microsoft's Web site and its developer network, MSDN.
For more information:
Dig Deeper on Active Directory and LDAP Security
Related Q&A from Joel Dubin, past SearchSecurity.com expert
The security of RFID chips and smart cards may not be fully mature, but there are best practices to keep facilities safe. Identity and access ...continue reading
Picture passwords for mobile device security aren't a new idea, but they have been recently improved. Identity and access management expert Joel ...continue reading
Hacked smart cards are a large potential threat to enterprises that utilize them. Learn how to thwart smart card hackers.continue reading
Have a question for an expert?
Please add a title for your question
Get answers from a TechTarget expert on whatever's puzzling you.