I have read numerous articles (and ServerFault answers) on CAL licencing, and thought I understand it. My understanding so far was that CAL licenses are related to users and devices directly accessing the server, i.e. ones which are using it within the network, similar to logging on to the server, using its print/file services, or otherwise accessing its services inside the company.
But according to this TechNet article about CAL licensing:
Do I need a CAL when my Windows Server is used to run a web server?
Windows Server 2012 R2 configured to run Web Workloads do not require CALs or External Connectors. Web workloads, also referred to as an internet web solution, are publicly accessible (e.g. accessible outside of the firewall) and consist only of web pages, web sites, web applications, web services, and/or POP3 mail serving. Access to content, information, and/or applications within the internet web solution must be publicly accessible. In other words, they cannot be restricted to you or your affiliate’s employees.
If you have Windows Servers configured to run a “web workload” these users will not require CALs or External Connectors.
However, let’s say you are using Windows Server to setup an online store where customers can buy widgets. You have front end Windows Servers setup to support your website, and back-end servers (e.g. commerce servers) setup so customers can check out and buy your widgets. The front end servers used to host your website would generally be considered as running “web workloads” and CALs or External Connectors will not be required to access these servers.
Once the customer adds a widget to their shopping cart, creates an account and enters their credit card and shipping information to complete the sale – they are now authenticated via your back end commerce servers/application (non-web workload). Since users are accessing the back-end commerce servers which web workloads are not running – CALs or External Connectors will be required for users to access these back end servers.
For me, the process of "creating an account and entering payment/shipping information" is confined to IIS. Does this mean the owner of the Windows Server machine needs to purchase as many CALs as there are users accessing "non-publicly available content"?
Does a Windows Server running IIS must really have a separate CAL for each physical user which has a web page account?