We're developing an ASP.NET C# application, which will contain an authentication system that authenticates users in multiple levels (user, admin, super-admin, etc.).
Our idea is NOT to use the built in ASP.NET forms authentication feature. Our plan is to create a whole 'new' system for it- based on the Session object, and SQL database contains users' info such as username & password.
Is there any SERIOUS difference between our idea and the Forms authentication feature?
What security risks do we take? How do we solve them?
Is this a good alternative for the forms authentication feature?
I would be curious to know the reason your aversion to the built in Membership providers.
Take a look at this link. http://msdn.microsoft.com/en-us/library/f1kyba5e.aspx It explains how to implement a custom MembershipProvider, which you can use to authenticate against any existing/planned database/store, whether it is session based (not sure how this would be persisted) or in a relational database.
Your requirement for Super users and Admin users etc falls nicely into the Role Provider system. It really is very easy to use and the ASP.NET team at microsoft have already considered the security risks and how to solve them.
Have a read of these two blogg entries by scott Guthrie:
http://weblogs.asp.net/scottgu/archive/2006/01/10/435038.aspx