There are a lot of articles out there about how to do this, but none seem to fit what I am trying to do. Can someone point me in the right direction?

Here's my scenario.

1. ASP.Net application with forms authentication
2.ASP site containsASMX web service I want to consume from vb.net windows forms application
3. If the user is validly logged into the ASP.Net site via a browser, then I want to grant access to the ASMX methods
4. If possible, I don't want to have to re-send new credentials
5. I need to protect the ASMX against anonymous users

I think I can exempt the ASMX from forms authentication with a <location> element in web.config

Now, when I establish a web reference in vb.net I can consume the service. But, how can I tell if the client running the vb.net application is logged in? Does this code belong on the client consumer or in the ASMX or both? How do I protect the ASMX from someone else consuming it.

I have read article after article -- with many variations on the theme -- it is really tough to find this specific answer.

See this http://www.velocityreviews.com/forums/t109671-security-of-web-services.html
hope it helps
:)