I am managing a web application that uses forms authentication. Most of it (including the login functionality) was written by a 3rd party so I cannot change it's architecture. The web application uses forms authentication to require all users to log in before they can access anything.
The application has an admin section that end-users should not be able to see and they are kept out of via forms authentication. But it doesn't look good that they can see the a login option and the 3rd party's branding.
Therefore I want to restrict access to this section of the application (which is actually implemented as a separate IIS Site) to certain IP addresses. So I installed the IPv4 Address and Domain Restrictions module and have set up some trial IP restrictions. But these setting do not have any effect. Why is this? Am I trying to do something that is impossible? (due to integrated authentication?)