Sept. 23, 2006

That isn't exactly easy nor perfectly "sharable" between those
applications.

The closest you could probably get, is to have the Web application be Forms
Authentication... which then means no windows authentication, which means
each user will have to provide a username and password, which you need to
maintain in a secure database.... you could then use the same code to query
the DB and see if the user is authenticated/authorized to logon, which could
be used in both the windows/web applications.... however, just make sure the
communication channels are secure for this information. The web application
would require the user sending the username/password over the internet (or
intranet), which means you'd need something like SSL to protect it from
someone sniffing the wire.

Although the abstraction of the Biz/Data layer is pretty good at being
re-usable between applications..... when you get to security - there are
un-avoidable differences between application types... and require each
unique thought and coding.

I hope this helps lead you in the right direction...