SQL server has two licencing modes, per cal, and per processor. If a sql server is accessed by a website on the internet, you have to use per processor, as even though only 1 user (the aspnet user) hit's it, it's effectively proxying for an unknown number of anonymous users. so you need to licence per processor. You can only use CAL's where you are connecting via windows authentication, as in that case SQL know's who is connected. SQL will actually let you connect with more concurrent users than your CAL limit, but you will be in violation of the licence, and it expects you to purchase additional cal's ASAP.

Cathal