I've scoured the internet for an answer to this question, so I'm assuming the scenario isn't as common as I think, or people are purposely looking the other way because they don't want to know the answer :)
The application in question is pretty simple - An ASP.net web application using ASP.net forms auth (no end-user Windows Authentication). Using Windows Server 2008 Web Edition, we've confirmed that no Windows CAL is required on the front-end web tier.
So then on the back-end data tier (SQL Server) it also seems pretty straight forward. As far as I can tell, the SQL Server licensing makes it pretty clear "...users who input data into, query, or view data through a web-based application... require a CAL". So that makes it pretty obvious, you need a CAL or a per-processor/pre-core license of SQL Server.
Here's where it gets tricky... What about the licensing requirements for the Windows Server that SQL Server is running on? Do we need aWindowsCAL for each connection from the Web Tier to the SQL Server? Note that Windows CALs and SQL Server CALs are completely separate in terms if purchasing, and nothing says a SQL Server CAL is of a higher order than a Windows CAL (thereby covering both).
It would seem ridiculous (IMHO) to allow unlimited connections to SQL, but then dump you back to the CAL model on Windows (since there is no "unlimited" option in Windows Server). But licensing is a strange beast, and non-compliance is not something I'm interested in.
Any insight with pointers to Microsoft documentation would be greatly appreciated!
Thanks guys,