title: SQL Server Authentication for Website Login
body: <p>A client requested that we develop a site for them but instead of the standard ASP.NET authentication or using Active Directory accounts, they would like us to use SQL server accounts for authentication. (That is, an account using SQL Server authentication.)</p>
  
  <p>This website would be exposed to the public Internet and would have users that are not employed by the client and the client's Active Directory is not available in their DMZ.</p>
  
  <p>So I have a few questions on this:</p>
  
  <p>1) Is this a good idea? (Our gut feeling is that it's not.)</p>
  
  <p>2) How should we best go about doing this?</p>
  
  <p>Off the top of my head, the best answer I can come up with for how to do this would be to dynamically build a connection string based off the credentials the user enters in a web form. If the connection is successful, continue to the site. Otherwise, kick them back out to the login page. (And, of course, make sure accounts get logged out in the event of too many failed logins.) </p>
  
  <p>Is there a better way?</p>
  
  <p>Thanks.</p>