Have a look at the ibuyspy sample (www.ibuyspy.com) which implements SQLServer based roles authentication pretty well!