Hi!
my user will use form authentication against Active Directory or database. Theres no Windows Integrated Authentication there!!
What i want is when the user submit the authentication form, it will try to validate the user against Active Directory and if it fail, try with the database.
How can i do that? What i had in mind was to build a custom membership provider that will encapsulate the logic but im not sure how to start.
is there any better idea?
As you said, you're best of creating a custom membership provider to handle this situation.
MSDN has a good overview of creating a custom membership provider:
http://msdn.microsoft.com/en-us/library/aa479048.aspx
There's a great example of an ODBC membership provider on the following page:
http://msdn.microsoft.com/en-us/library/6tc47t75.aspx
It should give you a good start.
The only way you are going to be able to implement this is by creating a custom provider.
In a perfect world, you could simply create a facade provider and then leverage the appropriate provider, SQL or AD, as necessary, to authenticate and return MembershipUser to whatever degree of completeness you find necessary.
In the real world, this is still possible but you will need to jump through a few hoops:
providers child element of the membership element AND set it as defaultProvider in the membership elementMembership.Providers collection to perform the functions as needed.You may find that you need to repeat this pattern if you need to use roles and while it is applicable, the implementation will be a bit more complex and beyond the scope of this post.
Alternately, full source code for the SQL providers can be found here and are a great starting point and guidance for implementing an industrial grade custom provider.
I would suggest first exploring the path of least resistance (and least labor and headache) and spike a facade before attempting to implement a custom security feature from scratch.
Good luck.