jon.vickers wrote: The problem I am worried about is tieing 3-4 applications to one central db that could cause all applications to fail. Right, that's where the hardware & server system architecture becomes critical; i think you could build a db server that would be pretty darn bullet-proof. jon.vickers wrote: The browser will not send the cookie to another domain, right? I don't think so, not without something you build from scratch. Given the choice between building a web service and building a component, I'd build a component and register it in the GAC, the performance will be much better and much more scalable than a web service. jon.vickers wrote: transfering an authenticated users from Application A on domain A to application B on domain B The only thing I can think of (with my little brain) is to stick a name/value pair in a query string and then hash the query string and retrieve it and un-hash it in application B. What a piece of work is man, how noble in reason, how infinite in faculties, in form and moving how express and admirable . . . and yet to me, what is this quintessence of dust? -- Hamlet, Act II, Scene ii.