I've been researching this as well, and racking my brain on how to get this to work, and finally figured it out. So I figure I'd give everyone my way of doing it. It's not clean, but it'll work. This process could be implemented for other pages and method of creating pages.
I created a page using PHP with a login form. It uses LDAPS connection to authenticate the users. This is working fine.
Then I wanted to be adventurous and change it, so that people who are already on the domain, doesn't have to log in. This work fine by reading the $_SERVER['REMOTE_USER'] credential field, but requires me to turn on Windows Authentication. This is fine and dandy, but it completely ignores my Login Form, and there are a few users that are debug and test users and contractors that we didn't want to add into AD, so they're kept up in a MySQL database. Without the login form, they cant log in!!
Also, if the user uses Firefox, it doesn't pass the $_SERVER['REMOTE_USER'] credentials anyway.
To fix the login page, I copied the page, add a _SSO (single sign on) after it. So now my application is "www.mywebsite.com/testapp", would be "www.mywebsite.com/testapp_sso/". One will have Windows Authentication, one with Anonymous Login. Then, I use IIS7 URL Rewrite, so when they access the testapp, and their IP address, which is $_SERVER['REMOTE_HOST'], is within our subnet, it would do the URL rewrite to the _SSO folder.
Next step, you can also add another URL redirect rule for "firefox" _SERVER["HTTP_USER_AGENT"]. So this would force everyone, even if they are in the IP range, to fall to the non _SSO page. So even if they are on our network, Firefox users still see the good ol' login page that everyone else sees instead of the Windows Authentication pop up that's horrid.
Final step, is to add a URL masking, so that the users have no clue that they're on testapp_SSO, or testapp.
That will be all for the users side. But now everytime you want to update one page, you have to copy it over to the _SSO folder as well. You could create a sync using some sync software, but you can also create a hard Symbolic Link!
The permissions will all work between the two folders, and you only have to update one.
Yes yes, if this was Linux, it'd be so much easier. But we have to use IIS here.