In my web application a web service is being called.
I'm looking for best practices / guidelines for logging into a web service, so I know there is more to an authorized user trying to access it.
Nice article on authorization in WCF . It discusses many options.