Thanks for the beers Allister!
I don't see how you can authenticate a user based on ip address unless you have a table mapping ip addresses to specific users. If ip addresses are assigned by dhcp and not static there is no way to do it, you can know its a user on the local network but you can't know which user, so how will roles be applied?
Best,
Joe