We’re developing an ASP.NET MVC 4 web application for IIS7.5 and IIS8. This web application will only be an intranet site. The app needs to be accessible to internal, desktop users (think Windows Authentication) AND internal mobile devices (e.g., iPads, iPhones, Android tables and phones, etc.) via the corporate wifi network (think forms authentication).
Since we need the same ASP.NET app/IIS web app to be accessible and provide authentication for both desktop, Windows authentication users and mobile, form authentication users, we’re unsure of how to set all this up and make it work.
Ideally, what we want is:
If a user goes to the intranet site using a mobile device, IIS and ASP.NET will route the user to a login form to enter credentials (user name and password that we’ll store and manage in our SQL Server DB)
If a user goes to the intranet site using a desktop browser, the user will be authenticated via Windows authentication, and if Windows authentication fails, IIS and ASP.NET will route the user to a login form to enter credentials (user name and password that we’ll store and manage in our SQL Server DB)
Using IIS7.5/8 and ASP.NET MVC4, is such a scenario possible? If so, how do we set everything up?
What is the IIS App Pool like? Integrate Managed Pipeline Mode or Classic? And what app pool identity?
For the web app in IIS, do we have Anonymous Authentication enabled or disabled? ASP.NET Impersonation? Forms Authentication? Windows Authentication?
For the ASP.NET MVC 4 app, what goes in Web.config for the <authentication>, <authorization>, and <identity> elements? Forms authentication? Windows authentication? Impersonation or not?
For the ASP.NET MVC 4 app, do we need to write custom code in the Application_AuthenticateRequest method of Global.asax?
Thank you!