I created a mixed mode authentication mechanism based on a few of the articles that I have read on this topic. It's similar to something like this: http://aspadvice.com/blogs/rjdudley/archive/2005/03/10/2561.aspx.
Basically, there are two web applications. One accepts the Windows Auth and one accepts Forms Auth. The Windows Auth then creates a forms auth ticket and passes control to the Forms auth application. This solution works fine when both applications are housed within the same IIS web site.
Now, order to control the security of this solution we set up multiple IIS web sites on the same machine. Web Site 1 serves external traffic (forms auth) and Web Site 2 serves internal traffic (windows auth).
So the design is that an internal user can hit the site using Windows auth via a internal name (myserver) while the external users use Forms Auth hitting http://somesite.com.
All that said, the solution works w ...
Go to the complete details ...