IIS authentication from J2ME app?

[Todd Christy]

I am building a J2ME application for a BlackBerry handheld device.
This application connects to an IIS server via HTTP to execute remote
ASPX-based services that collect and return data. We are working on
our authentication scheme, and trying to figure out the best approach
that will:

* Pass the ID and password via HTTP from the J2ME app to an IIS server
(preferably encrypted)
* Authenticate the ID/password combination against an available
Windows domain, based on authorized groups
* Return a session key to the J2ME app, for passing on each subsequent
call
* Allow us to set/maintain credential aging, so authentication
times-out after xxx hours

We are able to do some of this using IIS with Basic Authentication
(allowing a specified role in web.config), but don't see how to do the
session key or credential aging. Forms Auth seems to require us to
write our own code for Windows domain auth and aging. We are trying
not to write our own code where we can leverage existing features w/in
IIS. Is there an easier approach?