login control blues

I am cross posting from another group hoping to get a feed back:

I need to build a simple web apps with login control authenticating
with AD. Looking from security point:
1. web.config : connection strings etc.
OR
2. build my own onAuthenticate method calling ... a pre-compiled dll.
The dll will be a class file that uses directoryservices to validate
user.
This is asp.net 2.0 on win2k+3

.