I have a W2K8 Server with IIS 7.5 hosting two sites which are pointed to a single asp.net web application.
The web application has been configured for forms authentication and integrated (windows) authentication. The loginUrl is set to a login page that is configured for integrated authentication; if the user cannot be identified using Request.ServerVariables["LOGON_USER"] then the application redirects the user to a login page configured for forms authentication.
Problem is, when I hit the site as an anonymous user, IIS is issuing a 401 Challenge so the logic to redirect the user to the forms login page is never executed. I was advised to setup two sites and have them both point to the same web app; problem here is that the loginUrl property in the web.config is overwritten by changes on either site. How do I configure both sites to use different authentication modes?