title: Using Identity Models vs Custom Methods
body: <p>So I need to add user authentication to a web application I'm building - Web Forms, not MVC - and have been trying to read up on the Microsoft provided/developed Identity models with user and either roles or claims - I prefer roles, but it looks like MS wants everyone to switch to claims. While I understand it has built in capability, I was wondering if it is just simpler to salt &amp; hash a password, give users a software-defined "role" and test the user's role when loading pages. Or should I really try to do it the Microsoft way? Perhaps I just don't understand MS's framework well enough to implement.</p>
  
  <hr>
  
  <p><strong>A few questions:</strong></p>
  
  <ol>
  <li>Where are the users, roles etc stored? I believe these are placed in a custom generated database, but where?</li>
  <li>Is this database easily moved to a production database?</li>
  <li>How can I edit the roles to make them specific to my application? Apparently, MS has done away with the configuration tool that made this process easier. I can download an older version of Visual Studio to access the tool, but that seems rather cumbersome. </li>
  <li>The big one. I'm guessing that if I create my own self contained integrated authorization system I would not be able to use webconfig to authorize access?</li>
  </ol>
  
  <p>Thanks in advance. </p>