Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a W2K8 Server with IIS 7.5 hosting two sites which are pointed to a single web application.

The web application has been configured for forms authentication and integrated (windows) authentication. The loginUrl is set to a login page that is configured for integrated authentication; if the user cannot be identified using Request.ServerVariables["LOGON_USER"] then the application redirects the user to a login page configured for forms authentication.

Problem is, when I hit the site as an anonymous user, IIS is issuing a 401 Challenge so the logic to redirect the user to the forms login page is never executed. I was advised to setup two sites and have them both point to the same web app; problem here is that the loginUrl property in the web.config is overwritten by changes on either site. How do I configure both sites to use different authentication modes?

share|improve this question

migrated from Dec 7 '11 at 16:30

This question came from our site for professional and enthusiast programmers.

up vote 2 down vote accepted

ASP.NET does not support having multiple built-in authentication modules at once. This is prominent in the documentation, <authentication mode="[Windows|Forms|Passport|None]" ...>


  • Build a custom IHttpModule which handles authentication.
  • Separate your application into two web applications in your IIS, which point towards two different directories with different configuration files. This is the easiest solution.
  • Separate your application into two web applications in your IIS, but point both of them to the same directory. You will need to remove the authentication- and impersonation settings from the web.config residing in the directory, and move these into the system-wide web.config (%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Config\web.config or similar). These settings must be wrapped by location-tags using the name of the IIS-site.


<location path="My Awesome Site - Forms">
        <authentication mode="Forms" />

<location path="My Awesome Site - Windows">
        <authentication mode="Windows" />
        <identity impersonate="true"/>
share|improve this answer
thanks for the response. I was going to go with the last solution; but I was told that my netadmin is going to want to put deploy the app on another server in the DMZ so I guess I can just setup the application with a different config file. – Rich Dec 6 '11 at 21:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.