Check examples here:
http://msdn.microsoft.com/en-us/library/1b1y85bh(VS.71).aspxhttp://www.15seconds.com/issue/020305.htmConcept with DB or XML or web.config will remain same...difference is just accessing username/password.
at the end you will have to set FormsAuthentication cookie... upon successful validation.