I would use windows authentication for logging in and sqlserver for the groups. I did something similar a way back when. As you said, you can write your own implementation of the provided role/membership api classes/interfaces. Maintenance might be a pain since you keep ad and sql data in synch(users).