best explanations of security options in asp.net

using asp.net/vb.net 2008
what in your opininion are the best sites explaining security authorization approaches.
EX:  use canned version of Profile/Membership, assign users to a role, allow applicationID access based on role, etc...
this is the approach that I normally used but might need to do something based on AD or something similar.
thanks
MC
...