Hi all,
If it's helpful at all, I've taken a recent project of mine (built on S#arp Architecture 1.6) and deleted everything except the stuff related to user and security management. It's not runnable as is, but it has all of the code associated with our version of Rhino Security including domain, services, admin pages, controllers and tests. Feel free to reuse, redistribute, do whatever.
Hope this is helpful,
Billy McCafferty