Is it possible to specify conditional authentication methods in IIS (6 or 7) based on http headers? So for example mobile browsers would use a guest account while desktop browsers would need integrated authentication(AD)?
1 Answer
As far as I know there is no built-in way to have header information taken into account when the authentication method is determined.
One option is to use the URL Rewrite module. You could create a rule which examines the headers and if a desktop browser is used, redirects to a sub-site which is protected by integrated authentication. While mobile browsers would go straight through. This would mean you need two copies of your site.
Another option is to write your own authentication module and write your own response headers for desktop browsers. This way you can use a single site but need to write your own code handling parts of the authentication process. Ideally you want to avoid this.
Keep in mind that it is very easy to switch the user-agent to a mobile one in a desktop browser and so avoiding authentication.