>I agree about overkill.
>
>>Hi,
>>I guess I mentally included SQL Express when I said SQL Server. I know you can write your own provider (in fact I've done so) but I hadn't noticed any other off-the-shelf back-ends? And it can be overkill for very simple sites - for example where role management is not required...

+1. However, it's really hard to beat the directory-level role-based security feature.