Best way to set up web service for data access?

OK, I'm developing a web site that, as a part of its functionality, allows users to upload pictures.  I've got standard aspx pages set up for this, all working fine.  However, I also need to provide a web service that will work with a facebook app (being written by someone else) to allow people to export to our web site from facebook directly.

My idea is to allow the web service to have two functions:
Firstly an authentication routine and secondly an upload routine.  To allow the facebook app to upload pics, it will have to send a guid. It can only get this guid by successfully authenticating. However, the guid used is NOT the actual userID, rather at the point of authentication, I will store the incoming IP of the request and generate a new GUID. Then I'll use the authentication credentials to establish the REAL userID and write both the "fake" guid and the real userID into a sql data table along with an expiry time of twenty minutes or so and the user IP I established.  This way I never have to pass back the real userID, only a fake one that has a limited lifespan and will only work for the ip that originally generated it.

I've created some tableadapters in a DAL to access the SQL database and I've also written some BLL classes to interface with the web service (although if you see my other question in this section, I cannot, at the moment, get the web service to access the BLL class for some reason...).  Does this actually sound like a sensible way of going  about doing this or is there a hideous mistake I'm making here?