If you have a web application that will run inside a network, it makes sense for it to support windows authentication (active directory?).
Would it make sense to us
Basically windows handles everything, you never store usernames or passwords, AD and IIS do all the work for you
add this to your web.config
...
...
To configure Windows authentication
You can then deal with the business or authorization using web.config
again. for example
Read more here: http://msdn.microsoft.com/en-us/library/ms998358.aspx