We are currently building an application which will have users login and be tracked as they surf the site. I've looked into ASP.Net Membership but rather than use a username/password which the user or admin will have to setup, we've been asked to validate users against LDAP. Currently we are using Sessions, so once a user is validated in LDAP we allow them into the site and save information into a Session variable, which is then checked in the Master page to make sure it exists on all pages, if not the user is bounced to login.Is this a common approach, ok to do? Or is there a way using Forms Authentication and Membership to validate against LDAP rather than the SQL tables. So we can only use Membership for Roles, and not for creating users/passwords.Thank you.