Conditional client authentication

[Karl Lang]

Hi,

I'm looking for a bit of advice, and opinions.

I have inherited a webservice that currently only allows access from a
restricted set of IP addresses, controlled via IIS. I now have to extend
usage of the webservice to some remote users who may not have a fixed IP
address.

What are the choices to allow authenticated access to the webservice while
not affecting those who currently connect who don't require authentication?
All current clients are Windows XP/2000 but the new connection platforms are
unknown, so I'm going to assume its not only Windows/.NET clients. I can
make changes to the webservice but I don't want to interrupt the client
software if it can be helped.

So, does anyone have any suggestions, recommended reading?

Thanks in advance,
Karl