title: asp.net form authentication with active directory and access control
body: <p>I have been able to create a working ASP.NET web form authentication with Active Directory following this <a href="http://msdn.microsoft.com/en-us/library/ff650308.aspx" rel="nofollow">tutorial</a>.</p>
  
  <p>I have two questions (one of them might be specific to my need):</p>
  
  <ol>
  <li><p>I put in my own username and password in the <code>membership</code> element in <code>web.config</code> for <code>ConnectionUsername</code> and <code>ConnectionPassword</code>. It seems strange to me that while I am authenticating all users in the domain I need to put my own username and password in the <code>web.config</code>. I would imagine that the username and password from the login form should be used for this, unless I understand this incorrectly. Whose <code>username</code> and <code>password</code> do we usually put in the <code>web.config</code> in <code>membership</code> element?</p></li>
  <li><p>Out of hundreds of users in the domain, I need to give access to several users (let's say 20 of them) to several pages. I read about Active Directory access control but I don't want to go down that path. Is it common and sensible to have a table in the database with a list of usernames that has access to those special pages and do a match whether a logged-in user is in that table and authorize if so?</p></li>
  </ol>
  
  <p>Thank you for your input.</p>