HTTP 401 Challenge and HTTP 302 Login/Redirect won't work together in IIS7

Question

I am developing a website using .NET 3.5 that allow users to visit the site and create logins using the standard Microsoft login controls. However, users do not need to login to do general things like view products.

Now I need to setup the site so some of our Traveling Sales people are able to access it but not allow anyone else to access it. The easiest way I know how to do this is to turn on Windows Authentication for the Site in IIS7. When I do that I get all sorts of errors due to also having Forms Authentication turned on. If I turn Forms Auth then I get a different kind of error.

Does anyone know how to make Forms Auth and Windows Auth play nice on a single site in IIS7 or some other way to create a required login without having me kill Forms Auth?

Answer 1

Take a look at this article: http://mvolo.com/blogs/serverside/archive/2008/02/11/IIS-7.0-Two_2D00_Level-Authentication-with-Forms-Authentication-and-Windows-Authentication.aspx

It sheds some light on why this is the case and provides a somewhat limited workaround. Might work for you or put you on the right track.

Answer 2

The answer is that there is no way to do this in IIS7 currently. So I had to implement a special login.