You're only calling Read once so, logically, you're only reading one record. That said, there's no point bringing back every user name and password when all you really care about is if there is one that matches. The database can tell you that. Follow the Validate Credentials link in my signature for an example.