What are the high level steps to authenticate users of an ASP.NET MVC application against Active Directory?

I presume something like:

1. Modify web.config to use Windows authentication
2. Configure web.config to use the ActiveDirectoryMembershipProvider
3. Configure the web.config to use a custom RoleProvider that looks in AD

Does the above look sensible, and if so, where do I put the valid user detection logic?

In my case a valid user is someone on a specific AD domain.