All you need, I think, is Windows Authentication and ASP.NET Impersonation. Have the user login with their credentials, and the web app will run under that user's security context. Therefore, if the user has been granted permissions against SQL Server or Exchange, they'll be able to call its methods just fine.