IIS and CAL obligations

I am trying to identify CAL needs/costs for a .NET application we are
developing through IIS across http and https

The user enters a username and password in the web page (http or https) -
but its not a windows user - its an application user authenticated against a
database. I.e. user enters web page address in browser, first page captures
username and password held against our database server table.

1) If user connects via http from LAN/WAN/intranet is a CAL needed
2) If user connects via http from Internet is a CAL needed
3) If user connects via https from LAN/WAN/Intranet is a CAL needed
4) If user connects via https from Internet is a CAL needed

Sorry if this question is a bit stupid but we are not familiar with IIS and
CAL implications.