login restriction with ldap, but where to store the functional rights/access control list?

Question

Question is:

• LDAP authentication required
• Internal users automatically authenticated, external users requires login
• Where do I store complex access control rights?

In the AD/LDAP or in the Application itself (asp.membership db).

What is your experience and best practices suggestion?

Looking to build this in asp.net mvc 2 and using membership features, so best practice here i guess is that we roll our own custom provider to acomplish this...

Answer 1

I would have to say the best approach to this would be to adopt single sign on using membership login, but then implement your own access control for fine grained application access rights internally in your own system.