How are SQL Server CALs counted? [duplicate]

You need CAL's for every user of the business logic server, even though there is no direct connection between them and the SQL server. Microsoft use the term "multiplexing" for the scenario you describe.

This is for SQL 2005 but I don't think it is any different for other versions:

A CAL is required for each distinct device or user to the multiplexing or pooling software or hardware front end. This remains true no matter how many tiers of hardware or software exist between the server running SQL Server and the client devices that ultimately use its data, services, or functionality. An exception to this includes the manual transfer of data from employee to employee. For example, if an employee sends a Microsoft Excel version of a report to another employee, the receiving employee does not require a CAL. An additional exception is communication exclusively between the servers running SQL Server.

Anyone using your Application has to be covered by a CAL, including someone who uses it solely to generate Excel Reports but someone who only receives a copy of one of those Excel Reports by e-mail doesn't.

Edited to add This is just one of many aspects of SQL server licensing and it's only relevant if you choose the Server+CAL licensing model. If you want to get a full understanding of all of the alternatives the definitive document is Microsoft's 63 page SQL Server 2008 Licensing Guide which covers all licensing models and approaches.

Helvick said it all, but I just wanted to add that for your scenario it might be best to go with a processor licensing model, so you would need to pay for each processor on the database server rather than for each client accessing the server. Depending on how many cores your Server has and how much you expect traffic to rise the per processor route could be cheaper.

EDIT: Per Microsoft, Processor Licensing is per-processor, not per-core. So if you have an 8-core processor, you still just need one license, so long as it's a single chip/socket. (In the whitepapers for SQL 2008, they actually make it a selling point, saying that Oracle and others often charge per-core.)

On top of that note that there is different licensing available for internet facing systems - so you dont have to limit the users. Either you grab an internet license (for external users), or actually license through SPLA (Service Provider Licensing Agreement) in those cases.

In your particular case, you would need (if the requirements are accurate) exactly 100 licenses.

100 users, though - may not require ANY CAL - if you can run it on SQL Server Express. The limits are very ok for most scenarios... 4gb per database is quite a lot for many cases.