Thanks AndyC - I know my way around enough of CAS to implement system level security in a server application, but I didn't know it could be extended the way the article mentioned.   Thanks for the tip.