Hello,
I'm using Active Directory as an authentication for my Application. (hard for me to explain, but maybe with the simple chart , it can make it easier to understand).
*** Usually condition :
User --> Web Application --> Database
1. User login to Application <--> (Encrypted by client side encryption - sha 1 for example) <--> and then, if there are people want to intercept this user, they'll get the password that already convert to the hash that we use.
2. and then, the application will send the password to database and compare it.
3. if match with the password that store at the database, user with get the authorization from the application.
(if we use the hash for encryption on database, so, for more securing the application, we just need use client side encryption with sha 1 hash).

*** But, how if the system like this :
User --> Web Application --> Active Direct ...

Go to the complete details ...