Advisability of custom security extension?

I would like opinions on the advantages and disadvantages of implementing RS 2005 custom 'security extensions' to implement forms-based authentication.

The proposal on the table is a B2B extranet scenario. Customer is not thrilled about having to put a domain controller in the DMZ to support a windows authentication model for their web app, and having to maintain all those accounts via the Active Directory interface. Although it's technically feasable to roll your own security extensions for Reporting Services, my concern is having to deal with the inevitable upgrades to Reporting Services and SQL Server. Just how much of a nightmare will this be

How many people out there have actually gone this route, and what issues have you had to deal with I need to advise the customer accordingly on the advantages and disadvantages of custom security extensions.

Thanks for any real-world advice that you can provide.

If we have to use the Windows auth default security model, can anyone recommend any tools/approaches to maintaining Active Directory accounts that don't require a server administrator. Can you write some kind of wrapper application that could be used to easily maintain the AD accounts for the extranet application

M. Ramos