• The Role Provider section must be added to the following web.configs
• Central Admin
• The Security Token Service
• The Web application
• The <RoleProvider tag in the web.config must have:
• enabled=true
• a default provider like (<roleManager enabled="true" defaultProvider="AspNetWindowsTokenRoleProvider" )

• You keep getting the exception HRESULT: 0x800708C5 with the Active directory membership provider change password indicating that the password used does not conform to the domain password policy.
• As an admin, you are able to update the user password using that same password.

Probable cause:

• The active directory policy can be set to allow a “minimum password age”, i.e. users cannot change their own password before it is at least X days (default 1). The Administrator though does not have such restrictions when trying to update a user’s password.
• This can be checked at Start->Administrative tools->Group policy Management->Navigate the tree to the domain-> default domain policy –>right click edit->computer configuration –>policies –>windows settings->security settings-> account policies->password policy->check the entry for “minimum password age”
• If you want to reset it (mainly for development/testing purposes), just change it to zero. then go to command line gpupdate /force to apply the new policy

• The Page should inherit from LayoutsPageBase (Making it inherit from UnsecuredLayoutsPageBase will grant anonymous access to this page).
• Override the Properties RightsRequired and RequireDefaultLayoutsRights

       protected override SPBasePermissions RightsRequired
       {
           get
           {
               SPBasePermissions permissionRequired = SPBasePermissions.ViewPages;
               return permissionRequired;
           }
       }

       protected override bool RequireDefaultLayoutsRights
       {
           get
           {
               return false;
           }
       }

This will grant authenticated FBA users access to this _Layouts page.