title: Microsoft Asp.Net Identity 2.0 - Entity Framework vs. Custom Provider
body: <p>I am writing a new web site and am looking at Asp.Net Identity 2.0.  Out of the box, it uses Entity Framework for all of its data access.  For the rest of the site, we were creating middleware web services for data access.  Our original plan for security sake was that the web servers would talk to middleware and middleware would talk to the database via Entity Framework.  We had planned on blocking via firewall database access from the web server.  </p>
  
  <p>I see that I can create a custom provider for Identity 2.0 and it in turn could use middleware for it's data access.</p>
  
  <p>Here are my questions:</p>
  
  <ol>
  <li>Is it more secure to not allow the web servers to have direct database access?</li>
  <li>If it is more secure, why would Microsoft not build it that way out of the box</li>
  <li>If you were starting from scratch like we are, would you recommend using entity framework or writing a custom provider that goes through our middleware layer?</li>
  </ol>
  
  <p>Thanks.</p>