Provided you don't use dynamic SQL inside your stored procedure you should be able to give access to the xp_cmdshell command just specifically to the stored procedure and provide execute permissions for that stored procedure to the web user.

Alternatively, you could modify the stored procedure to insert a row into a queing table - a table of DTSRun requests if you like - and then create a job to run every minute or so and check this table, and run the DTS task from the SQL job based on the contents of the table.

Either of those should work without having to give full access to the web user.

Dave Hilditch.