How to configure two sites on same IIS 7.5 server for a single ASP.NET web application with different authentication modes

Question

I have a W2K8 Server with IIS 7.5 hosting two sites which are pointed to a single asp.net web application.

The web application has been configured for forms authentication and integrated (windows) authentication. The loginUrl is set to a login page that is configured for integrated authentication; if the user cannot be identified using Request.ServerVariables["LOGON_USER"] then the application redirects the user to a login page configured for forms authentication.

Problem is, when I hit the site as an anonymous user, IIS is issuing a 401 Challenge so the logic to redirect the user to the forms login page is never executed. I was advised to setup two sites and have them both point to the same web app; problem here is that the loginUrl property in the web.config is overwritten by changes on either site. How do I configure both sites to use different authentication modes?

Answer 1

ASP.NET does not support having multiple built-in authentication modules at once. This is prominent in the documentation, <authentication mode="[Windows|Forms|Passport|None]" ...>

Solutions:

• Build a custom IHttpModule which handles authentication.
• Separate your application into two web applications in your IIS, which point towards two different directories with different configuration files. This is the easiest solution.
• Separate your application into two web applications in your IIS, but point both of them to the same directory. You will need to remove the authentication- and impersonation settings from the web.config residing in the directory, and move these into the system-wide web.config (%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Config\web.config or similar). These settings must be wrapped by location-tags using the name of the IIS-site.

Example:

<location path="My Awesome Site - Forms">
    <system.web>
        <authentication mode="Forms" />
    </system.web>
</location>

<location path="My Awesome Site - Windows">
    <system.web>
        <authentication mode="Windows" />
        <identity impersonate="true"/>
    </system.web>
</location>

Answer 2

I realize this is an old question, but I was trying to do this very thing and was unable to; the answer proposed by Simon was not working for me. The way I got it to work was to handle it through code. In my case, I wanted for one site to allow Anonymous authentication and the other to use NTLM (Windows) authentication. These sites were both being hosted by a CMS, and so it's not as simple as setting authorization rules against paths, either.

What I wound up doing was checking the Request.ServerVariables["LOGON_USER"] value as well as Request.Url.Host and then forcing a response code of 401 to present the authentication challenge to the visitor's browser. I have both Anonymous and Windows authentication modes enabled in the Web.config file that is shared between the sites.

WebForms example:

// we only care about authorization for one of the sites
if (Request.Url.Host == "use-ntlm.example.com"
    && string.IsNullOrEmpty(Request.ServerVariables["LOGON_USER"]))
{
    Response.StatusCode = 401;
    Response.End();
    return;
}