Go and buy it now. Really. Right now. Wrox were good enough to send me a copy of this, and after two chapters I've already learnt stuff. The author is Stefan Schackow, a PM on the ASP.NET team, so he really knows what he's talking about, and it shows. There is a ton of material on how authentication works, including IIS, impersonation, ASP.NET, etc. Even if you don't need it now, one day you will, and this contains the most complete description of ASP.NET 2.0 security that I've seen. Go
here for more details, including the TOC and some excerpts.
[Listening to: Another Hit - Dave's True Story - Dave's True Story [1994]]