XPO and SQL Server Auto Increment Primary Key Fields

The business objects are in the .Module project. I have an ApplicationServer project as well. Must this be done in the ApplicationServer project, .Module project, .Module.Win project, or the .Win project?

In this scenario, use custom sessions both in the client and middle-tier applications. To use a custom Session type in XAF, create a custom Object Space Provider and override its CreateUnitOfWork method. See an example here: Security: Persist changed properties only when saving a changed business object record.

One last question:
In the application server I am using:
       private static void serverApplication_CreateCustomObjectSpaceProvider(object sender, CreateCustomObjectSpaceProviderEventArgs e)
       {
           e.ObjectSpaceProvider = new CustomObjectSpaceProvider(e.ConnectionString, e.Connection);
           //e.ObjectSpaceProvider = new XPObjectSpaceProvider(e.ConnectionString, e.Connection);
       }
public class CustomObjectSpaceProvider : XPObjectSpaceProvider
   {
       public CustomObjectSpaceProvider(string connectionString, IDbConnection connection) : base(connectionString, connection)
       {
       }
       public CustomObjectSpaceProvider(string connectionString, IDbConnection connection, bool threadSafe) : base(connectionString, connection, threadSafe)
       {
       }
       protected override UnitOfWork CreateUnitOfWork(IDataLayer dataLayer)
       {
           return new CustomUnitOfWork(dataLayer);
       }
       protected override IDataLayer CreateDataLayer(IDataStore workingDataStore)
       {
           var cacheRoot = new DataCacheRoot(workingDataStore);
           var cacheNode = new DataCacheNode(cacheRoot);
           if (threadSafe)
           {
               return new ThreadSafeDataLayer(XPDictionary, cacheNode, new Assembly[0]);
           }
           return new SimpleDataLayer(XPDictionary, cacheNode);
       }
   }
   public class CustomUnitOfWork : UnitOfWork
   {
       public CUnitOfWork(IDataLayer dataLayer) : base(dataLayer) { }
       public CustomUnitOfWork(IObjectLayer objectLayer, params IDisposable[] disposeOnDisconnect) : base(objectLayer, disposeOnDisconnect) { }
       protected override MemberInfoCollection GetPropertiesListForUpdateInsert(object theObject, bool isUpdate, bool addDelayedReference)
       {
           var defaultMembers = base.GetPropertiesListForUpdateInsert(theObject, isUpdate, addDelayedReference);
           if (!TrackPropertiesModifications) return defaultMembers;
           //Only Add Modified Members And Don't Add Members With IgnoreInsertUpdateAttribute
           var members = new MemberInfoCollection(GetClassInfo(theObject));
           members.AddRange(defaultMembers.Where(member => !member.HasAttribute(typeof(IgnoreInsertUpdateAttribute)) && member.GetModified(theObject)));
           return members;
       }
   }
In The Client It's set up to use:
               winApplication.CreateCustomObjectSpaceProvider +=
                   delegate(object sender, CreateCustomObjectSpaceProviderEventArgs e)
                   {
                       e.ObjectSpaceProvider = new DataServerObjectSpaceProvider(clientDataServer, securityClient);
                   };
DataServerObjectSpaceProvider
How can I implement the CustomUnitOfWork there?

I have researched this scenario and found that it is not necessary to use a custom UnitOfWork in the client application, i.e. it is not necessary to create a DataServerObjectSpaceProvider's descendant. I apologize for misleading you.
In addition, it is insufficient to create XPObjectSpaceProvider descendants in the middle-tier application, since this provider is used only to update the database. It is necessary to create a custom SecuredDataServer that uses a custom ISecuredSerializableObjectLayer. Here is an example:

C#
MySecuredDataServer dataServer = new MySecuredDataServer(  
    connectionString, XpoTypesInfoHelper.GetXpoTypeInfoSource().XPDictionary,  
            securityProviderHandler);  
ServiceHost serviceHost = new ServiceHost(new WcfSecuredDataServer(dataServer));  
serviceHost.AddServiceEndpoint(typeof(IWcfSecuredDataServer), WcfDataServerHelper.CreateDefaultBinding(), "http://localhost:1451/DataServer");  
serviceHost.Open();  
...  
public class MySecuredDataServer : SecuredDataServer {  
    public MySecuredDataServer(string connectionString, XPDictionary dictionary, QueryRequestSecurityStrategyHandler securityProviderHandler) : base(connectionString, dictionary, securityProviderHandler) { }  
    protected override ISecuredSerializableObjectLayer CreateDefaultSecuredSerializableObjectLayer(IDataLayer dataLayer, RequestSecurityStrategyProvider securityStrategyProvider, EventHandler<DataServiceOperationEventArgs> committingDelegate, bool allowICommandChannelDoWithSecurityContext) {  
        SecuredSerializableObjectLayer objectLayer = new MySecuredSerializableObjectLayer(dataLayer, securityStrategyProvider, allowICommandChannelDoWithSecurityContext);  
        objectLayer.Committing += delegate(object sender, DataServiceOperationEventArgs args) {  
            if (committingDelegate != null) {  
                committingDelegate(this, args);  
            }  
        };  
        return objectLayer;  
    }  
}  
public class MySecuredSerializableObjectLayer : SecuredSerializableObjectLayer {  
    public MySecuredSerializableObjectLayer(IDataLayer dataLayer, DevExpress.ExpressApp.Security.ClientServer.SecuredDataServer.RequestSecurityStrategyProvider securityStrategyProvider, bool allowICommandChannelDoWithSecurityContext)  
        : base(dataLayer, securityStrategyProvider, allowICommandChannelDoWithSecurityContext) { }  
    protected override SerializableObjectLayer CreateSerializableObjectLayerCore(IClientInfo clientInfo, IDataLayer dataLayer, IRequestSecurityStrategyProvider securityStrategyProvider, out UnitOfWork result_parentSession, out ISecurityRule securityRule, bool allowICommandChannelDoWithSecurityContext) {  
        ISelectDataSecurity security = new MyEmptySelectDataSecurity();  
        ISelectDataSecurityProvider selectSecurityProvider = securityStrategyProvider.CreateAndLogonSecurity(clientInfo);  
        if (selectSecurityProvider != null) {  
            security = selectSecurityProvider.CreateSelectDataSecurity();  
        }  
        UnitOfWork directSession = new MyUnitOfWork(dataLayer);  
        SecurityRuleProvider securityRuleProvider = new SecurityRuleProvider(dataLayer.Dictionary, security);  
        SecuredSessionObjectLayer sessionObjectLayer = new SecuredSessionObjectLayer(allowICommandChannelDoWithSecurityContext, directSession, true, null, securityRuleProvider, null);  
        result_parentSession = new MyUnitOfWork(sessionObjectLayer);  
        securityRule = securityRuleProvider.securityRule;  
        return new SerializableObjectLayer(result_parentSession, true);  
    }  
}  
class MyEmptySelectDataSecurity : ISelectDataSecurity {  
    public IList<string> GetObjectCriteria(Type type) {  
        return new string[0];  
    }  
    public IList<string> GetMemberCriteria(Type type, string memberName) {  
        return new string[0];  
    }  
    public bool IsGranted(IPermissionRequest permissionRequest) {  
        return true;  
    }  
    public IList<bool> IsGranted(IList<IPermissionRequest> permissionRequests) {  
        Guard.ArgumentNotNull(permissionRequests, "permissionRequests");  
        List<bool> result = new List<bool>(permissionRequests.Count);  
        for (int i = 0; i < permissionRequests.Count; i++) {  
            result.Add(IsGranted(permissionRequests[i]));  
        }  
        return result;  
    }  
}  

Thank you very much Anatol. No problem at all, I definitely learned more about the framework by experimenting with different setups for XAF applications. I understand the current Application Server is still in beta mode and have been reading about other developers requesting data caching capability for the app server.
I have implemented your solution and have noticed that TrackPropertiesModifications always returns false.
Is that because of the DataServerObjectSpaceProvider in the client?
or does this have to do with OptimisticLockingBehavior on the business object?