There are two parts to your application: a Web-based customer-facing front end and a back end directory service or data store with authenticated users. The authentication feature in .NET needs both pieces. Since a user directory is required, no matter what you do, the issue isn't just about only relying on the .NET membership classes on the front end. It's also about the directory services, and connecting to them on the back end.
Here's a quick overview of authentication in .NET with some options to consider.
On the Web side, ASP .NET 2.0 provides ready-made code for creating log-in pages and server controls. Prior versions of ASP .NET didn't have this feature, and log-in pages for new Web applications had to be coded from scratch.
On the directory side, there are two built-in membership classes for connecting to Active Directory (AD) or SQL Server, which is no surprise since both are also Microsoft products just like .NET itself. The two classes, ActiveDirectoryMembershipProvider and SqlMembershipProvider, work with a configuration file called Web.config.
But, if you want to use some other directory service, a custom provider can be created by deriving from the MembershpProvider abstract class and tweaking the Web.config file.
Either way, these provider classes manage all the heavy lifting for connecting to the directory services, whether they're Microsoft or not. They are used for adding and deleting users, modifying users and their groups and other access management tasks, such as changing passwords.
The question isn't whether the .NET authentication framework is secure enough; it's how secure is the back-end directory service, which is what drives the application. Since .NET is compatible with its sister Microsoft product, AD, it would probably make the most sense to stick with that.
If flexibility is an issue, there are many options that allow access to multiple directory services for the same application. The details, however, are beyond the scope of this brief answer. Code and instructions are available on Microsoft's Web site and its developer network, MSDN.
For more information:
Dig Deeper on Active Directory security
Related Q&A from Joel Dubin
Learn about the purpose of CAPTCHA challenges that enable websites to differentiate bots from authentic users to stop spammers from hijacking forums ... Continue Reading
Proper planning is at the top of the list for single sign-on best practices, but it's important to get enterprise SSO implementations off to a good ... Continue Reading
After a server room door has been compromised, finding a more secure solution is of utmost importance. Learn how to choose a server room door that ... Continue Reading