title: Forms Authentication
body: <p>I've been programming for a long time now, but I'm not the world's most experienced.Net developer.  I recently picked up a project that is using Forms authentication for their website.  I first looked at forms authentication in .Net 1.1 and at that time it had some limitations that made me decide not to use it as my primary form of authentication.</p>
  
  <p>This project requires that users have roles (which I understand forms authentication supports) and group memberships.  For example "User A" is an "Admin" for "Company A".  Does forms authentication now support this sort of user structure?</p>
  
  <p>I've also read that forms authentication sends passwords back as plain text.  This client does not use SSL.  Is this true?</p>
  
  <p>The current code base uses forms authentication, but does not support groups (it does support roles).  So, I need to either modify the forms authentication to support the required groups or rip out the forms authentication and use the Authentication framework I normally use.  If forms authentication does support groups and is secure enough, then I should stick with that.  If forms authentication has security issues or does not support groups then I need to remove that form of authentication.</p>
  
  <p>I've searched the internet for a pros-and-cons sort of article, but no luck.  What do you guys think?</p>