Hi,

1.) We have a central database of shared values that is maintained by an
asp.net app.  Only a few admins have access to the maintenance forms for this
data which is secured by a simple web.config in forms folder for now.

2.) This application also exposes some webservices that allows client
applications to consume the data that is maintained within it.

How can I restrict which of our intranet applications consume the
webservices? IOW, apps A & B can access the webservices but C, D, E can't.  
I want to determine which app is requesting the webservice to grant or deny
access.   When I debug, and make web service request from a client app, I see
the global.asax events in the shared app get fired.  Is this a good place to
check any credentials being passed? If so how or what can I check?  

We use Active Directory and have Integrated security set on the shared
application and client applications.

Thanks, Dave.