Hi Osa,
there are a few different strategies you could take, this is one which is probably one of the easier ones;
a) create a Login method, takes 2 parameters, login and password.
b) process the login as for a web app - ie do lookups or whatever and set the session values as you wish.
c) call p_web.ValidateLogin(true) to set the session as "logged in".
then the client has to
a) call this method to login
b) make sure they set the SessionID Cookie when making subsequent requests.
cheers
Bruce