You need to build SOAP request manually/programatically where you can build
your own SOAP envelop and body. You can pass on your cradential etc. there.

Try searching for "submit programatically" phrase and you will get lot of
sample codes to work with.

for anyone who is interested.
It appears the correct way is to write a web service allowing the user to
interrogate the details from WScript.Network to get the username and domain
and computername.
This can then be passed in with the Infopath document in fields, and used to
check for a role membership.
This implies that in fact InfoPath alreaady passes in Credentials and it is
my use of Contect.User rather than System.Envirnment etc that is the fault.

hope this helps anyone wondering how best to validate the cleint user.
I then return a "Access not allowed" message on failiure of IsInRole