I have a W2K8 Server with IIS 7.5 hosting two sites which are pointed to a single asp.net web application.

The web application has been configured for forms authentication and integrated (windows) authentication. The loginUrl is set to a login page that is configured for integrated authentication; if the user cannot be identified using Request.ServerVariables["LOGON_USER"] then the application redirects the user to a login page configured for forms authentication.

Problem is, when I hit the site as an anonymous user, IIS is issuing a 401 Challenge so the logic to redirect the user to the forms login page is never executed. I was advised to setup two sites and have them both point to the same web app; problem here is that the loginUrl property in the web.config is overwritten by changes on either site. How do I configure both sites to use different authentication modes?

2 Answers 2


ASP.NET does not support having multiple built-in authentication modules at once. This is prominent in the documentation, <authentication mode="[Windows|Forms|Passport|None]" ...>


  • Build a custom IHttpModule which handles authentication.
  • Separate your application into two web applications in your IIS, which point towards two different directories with different configuration files. This is the easiest solution.
  • Separate your application into two web applications in your IIS, but point both of them to the same directory. You will need to remove the authentication- and impersonation settings from the web.config residing in the directory, and move these into the system-wide web.config (%SystemRoot%\Microsoft.NET\Framework64\v4.0.30319\Config\web.config or similar). These settings must be wrapped by location-tags using the name of the IIS-site.


<location path="My Awesome Site - Forms">
        <authentication mode="Forms" />

<location path="My Awesome Site - Windows">
        <authentication mode="Windows" />
        <identity impersonate="true"/>
  • thanks for the response. I was going to go with the last solution; but I was told that my netadmin is going to want to put deploy the app on another server in the DMZ so I guess I can just setup the application with a different config file.
    – Rich
    Dec 6, 2011 at 21:41

I realize this is an old question, but I was trying to do this very thing and was unable to; the answer proposed by Simon was not working for me. The way I got it to work was to handle it through code. In my case, I wanted for one site to allow Anonymous authentication and the other to use NTLM (Windows) authentication. These sites were both being hosted by a CMS, and so it's not as simple as setting authorization rules against paths, either.

What I wound up doing was checking the Request.ServerVariables["LOGON_USER"] value as well as Request.Url.Host and then forcing a response code of 401 to present the authentication challenge to the visitor's browser. I have both Anonymous and Windows authentication modes enabled in the Web.config file that is shared between the sites.

WebForms example:

// we only care about authorization for one of the sites
if (Request.Url.Host == "use-ntlm.example.com"
    && string.IsNullOrEmpty(Request.ServerVariables["LOGON_USER"]))
    Response.StatusCode = 401;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.