title: Web service calls and proxy authentication in the real world
body: <p>We are developing an app that consists of a web server that hosts a web service (amongst other things) and a client that will be communicating with that web service.  Both the client app and the server are expected to be used within a corporate firewall.  This application will be packaged up and deployed to organizations across the world—so it needs to be flexible enough to work in multiple types of environments.</p>
  
  <p>My question revolves around web service authentication and what is appropriate for real world scenarios.  I know some companies have proxy servers that require a separate authentication.  How often is this a requirement across organizations?  When does the proxy server force the user to authenticate (can you access internal sites without authenticating.. is the authentication for only external sites)?</p>
  
  <p>Reason I ask these questions, is I’m not sure what kind of capability we should build into our client application for authentication to the web service.  By default, we are taking the current user credentials and passing that up to the server.  Do you think this is sufficient?  In a case where a company will require some form of alternate authentication for internal access, this will not work.  My question revolves around this last case—how often does it happen?  Why would a company force alternate credentials for internal access?</p>
  
  <p>Thanks!</p>