What is difference between adding user to roles and adding user to group?Can you please give some explaination.
I usually just add users to groups, because it seems simpler:
Roles can be added to sharepoint groups, while you cannot add a sharepoint group to another sharepoint group.
If you use your membership database in other applications, the roles travel with it. SharePoint groups are stuck in SharePoint.
The default sharepoint groups, including permissions, are already defined for you.
You can add both fba users and active directory users to SharePoint groups.
Roles can be added to sharepoint groups, while you cannot add a sharepoint group to another sharepoint group.
If you use your membership database in other applications, the roles travel with it. SharePoint groups are stuck in SharePoint.
One advantage Roles have over groups is that SharePoint thinks that FBA Roles are actually users. This means you can add them to SharePoint groups (whereas you can't add a SharePoint group to a SharePoint group).
Also you can add them to anywhere that just 'users' are allowed like site owners. This gives an additional level of flexibility.
best practice seems to be allocate security at SharePoint group level (it is SharePoint specific); add users not to SharePoint groups but to FBA Roles as they are concerned with identity and travel 'across' Site Collections and then assign roles to SharePoint groups.
Also you can add them to anywhere that just 'users' are allowed like site owners. This gives an additional level of flexibility.
best practice seems to be allocate security at SharePoint group level (it is SharePoint specific); add users not to SharePoint groups but to FBA Roles as they are concerned with identity and travel 'across' Site Collections and then assign roles to SharePoint groups.