I'm currently developing a MVC3 web application that needs to require extranet users to log in and be authenticated using Forms Authentication. Intranet users should be logged in automatically using Windows authentication.
I've found this article,
http://aspalliance.com/553_Mixed_Mode_Authentication.all
but it's dated Nov 2004 and like to find something written more recently than 7 years ago.
My plan is to have two applications in IIS, with virtual directories pointing at the same physical directory, but one will allow Anonymous Access and the other will not.
When a user is authenticated on the Windows/Intranet side of things, I hope to simply simulate the user logging in via forms authentication. Are there any pitfalls to this approach? Any better ideas?
EDIT: 7/22/2011
I'm using IIS7 which won't allow me to do many of the things suggested in the older articles. Due to authentication being integrated a bit tighter between IIS7 and the ASP.NET web sites, certain things aren't allowed. For example, I can't set Windows Auth on a single file while the rest of the application is using Forms Auth.