When you take advantage of the authentication methods made available through the operating system or a third party, you get the benefit of using tools that have already been developed and tested. Okay, we're making an assumption about that tested part, but play along with me here. Still, even with these tools at our disposal, there are situations where more is required. If your application maintains is own user list or requires additional information above and beyond the user id and password, you are forced to create your own technique. And that is what we are faced with in our sample web service. Along with the user id and password, we need to gather a company identifier. In other words, none of the 'standard' techniques will be sufficient for our purposes, leaving us with no choice but to create our own authentication system.