Internet-facing deployment (IFD) uses Active Directory to authenticate a user. The user can access Microsoft Dynamics CRM from an internal network or from the Internet. Either way, the user must have an account in Active Directory.
The process to authenticate a user under IFD resembles Active Directory authentication. However, the licensing model specified when you access the CrmDiscoveryService Web service is a Microsoft Service Providers License Agreement (SPLA). In addition, a ticket must be obtained and set in the CrmAuthenticationTokenValue property value instance of the CrmService instance.
This Site very usefull to Configure IFD with CRM 2011>>>
Configuring IFD with Microsoft Dynamics CRM 2011
