If I haven't misunderstood things completely, then a integration provider must be used when using a membership provider external to Community, to allow Community to save it's user specific data. Can this be done when the external membership provider is the AD provider?

How would roles be set up? Is it possible to get the AD roles and also add roles in Community (without affecting the AD data), i.e. a user can be in a role in the AD, and be added to a role specific to Community and then given permissions to various objects in Community based on either or both of these roles?