I am confused over Windows CAL on web service. I read from the book page 51:
"If a client accesses web server and does not authenticate via a Windows account, is in an anonymous user or when using Form authentication in ASP.Net, then no CALs are required."
However someone told me even people was authenticated by an application who were considered authenticated user and CAL was required. So I asked local Microsoft customer service and he ask me to refer to page 10 of Windows server 2008 licensing guide:
"Q: If a user or device accesses a server running Windows Server 2008 but is authenticating via a third-party authentication application (non-Microsoft based authentication), does the user or device still require a Windows Server 2008 CAL?
A: Yes, if the user or device is authenticating by any means to a server running Windows Server 2008, it requires a Windows Server 2008 CAL."
We don't intend to authenticate users as Windows users. Now I doubt whether I need to purchase Windows CALs for running an IIS based web server accessing SQL Server and the users are ASP.NET Forms authentication.

As I understand it, the generally accepted interpretation of Microsoft's licensing requirements are:-

For Windows Server, including IIS, the arrangement is as described in the book: CALs are required for users autheticated by Windows (i.e. Active Directory) but not for users logging in to a website via the standard kind of web form. In other words, if the user was logged in as IUSR_WHATEVER before they log in to the website, and are still logged in as IUSR_WHATEVER after they log in to the website, the user doesn't need a CAL.

But for SQL Server it's a very different story. SQL Server must be licensed for each device that connnects, even if that device is connecting through some kind of multiplexer--and IIS counts as a multiplexer. And it doesn't matter if the users are logged in to the website or are anonymous users--they each require a CAL. The practical upshot is that websites will almost certainly have to buy a per-processor lincense rather than a per-user license. When you look into the cost of per-processor licenses, you will quickly realise why so many websites use mySQL.