BINGO. Worked like a charm testing locally, will test again tomorrow in the dev environment.

In this particular case, the client is going to provide us with a list of possible ip's they'll be connecting to the service with, and we'll be able to associate at least a list of ip's with the user account. agreed, it's not a perfect solution, but it's the one i've been charged with implementing. i'd be delighted, however, to hear an alternative approach i can sell to the powers that be?

Thanks again muchly for the tip, feels good to be unstuck.

c