How to choose right approach to authentication and authorization

Question

I am building a plugin for multiple .NET based solutions. The application it self will connect to a database that holds user data and user group data, as well as some configuration files that users create for them selves. The configurations may also be shared between users (the owner can share his configurations with another user), and administrators will be able to edit all permissions on all files(my guess is via some web interface).

The applications that will have access to the functionality of this plugin are using the .NET platform but after that the projects diverge. One is using old win forms, the other WPF for desktop and another is web based using a JavaScript library. All the aforementioned applications are just interfaces for a shared lib that contains actual business logic.

My plugin will be implemented within the shared business logic library. The app will support both username and password authentication as well as windows authentication(if win auth fails the all will ask for username and password to try to access data that way).

My options regarding membership and authentication/authorization are plentiful and I'm not sure of my choice. I can use the Membership library or the new Identity library. I am also sure there are 3rd party libs that are quite good at this stuff but I have yet to hear of them.

is there a preferred lib to use or is the choice trivial and i should just start from somewhere?

Answer 1

This is a great place to start: http://brockallen.com/category/membershipreboot/