I am confused over Windows CAL on web service. I read from the book page 51:
"If a client accesses web server and does not authenticate via a Windows account, is in an anonymous user or when using Form authentication in ASP.Net, then no CALs are required."
However someone told me even people was authenticated by an application who were considered authenticated user and CAL was required. So I asked local Microsoft customer service and he ask me to refer to page 10 of Windows server 2008 licensing guide:
"Q: If a user or device accesses a server running Windows Server 2008 but is authenticating via a third-party authentication application (non-Microsoft based authentication), does the user or device still require a Windows Server 2008 CAL?
A: Yes, if the user or device is authenticating by any means to a server running Windows Server 2008, it requires a Windows Server 2008 CAL."
We don't intend to authenticate users as Windows users. Now I doubt whether I need to purchase Windows CALs for running an IIS based web server accessing SQL Server and the users are ASP.NET Forms authentication.