1. In a default setup, users with an admin role will have permission to access On Demand web services. Access to web services has to be allowed either by Oracle's support people, or the local admin. Even then, Oracle may have to grant your local administrators the ability to set this permission.
2. If you need custom fields that are unique to your client, you'll have to generate a new plug-in using the WSDLs you can get through the admin page. You will be offered a WSDL 2.0 or 1.0 - the plug-in will work best with 1.0 so don't be tempted to go with the latest and greatest.
3. One other note on WSDL 1.0 vs. 2.0: if you do go with 2.0 be aware that the two web services have different access to child objects. In 1.0, an opportunity has a list of child contacts, and vice versa. In 2.0 web services that relationship does not exist.
4. Custom fields may not appear in the WSDL where you think they should be. Custom fields are given one single name that will never change, even if the admin changes the custom field name. You will need to go into the admin pages on object / field setup to see the original names of things. Very often the correct custom field name will be qualified by field type, etc: for example, a custom currency field "CalculatedPrice" will probably be called "c_CalculatedPrice". You'll see "s_" for strings or "pl_" for pick lists, etc.
5. Case-Sensitivity is an issue for Oracle. If you set the plug-in so that it's case-insensitive, lookups on a single ID will be slow. This is because it will still do a table scan and ignore the index. If you set the plug-in so that it is case-sensitive, searches on name or other fields will be of limited use.