<p>I have some question:</p>

<p>How to make a role based web application? Such as in forum sites, there is many user types, admin, moderator etc... is the roles of these user types stored in database or web.config? And when a user login to our site, how to control this users roles? In short I want to learn about authorization and authentication. </p>

<p>Thanks..</p>

Check this articles and videos:
Introduction to Membership
Managing Authorization Using Roles
Creating the Application Services Database for SQL Server
Examining ASP.NET 2.0's Membership, Roles, and Profile
Membership and Role Providers in ASP.NET 2.0
(Tutorial)
ASP .NET Security Videos