io l'ho scritto così

codice:
    <forms name="logForm" loginUrl="login.aspx" protection="All" timeout="120">
		<credentials passwordFormat="MD5">
			<user name="username" password="password" />
		</credentials>
    </forms>