ASP.NET Membership - Can I allow anonymous access and still use automated login using Active Directory?

Question

I hope this is not to paradoxal, but I don't know how this should be done...

I have a VS2008 ASP.NET MVC Project with the following Web.Config entry:

  <authentication mode="Windows">
      <forms name=".ADAuthCookie" timeout="10" />
  </authentication>

This makes the visitor logon automatically with their DOMAIN\username login which they used to logon to Windows. (Right?)

This works with my development server (http://localhost:xxxx), but not with my IIS server (http://localhost). Probably because the development server is 'started' by my local user (which has ActiveDirectory read-rights on the domain) and because IIS is 'started' by the IUSR_WORKSTATION user which does not. (Right?)

If all of the above is true, how can I impersonate the IIS user (for instance to my own username) to solely authenticate the current user with the Windows login name? (like the example below)?

Or should the IUSR_WORKSTATION user be granted ActiveDirectory? read-rights (not preferred as I will be switching servers / IUSR_ users a lot)

<identity impersonate="true" userName="DOMAIN\myuser" password="mypass"/>
<authentication mode="Windows">
    <forms name=".ADAuthCookie" timeout="10" />
</authentication>
<identity impersonate="false"/>

Answer 1

Windows authentication is poorly named (IMO). It's not using Windows as the authentication, but rather it delegates the authentication process to IIS. So you need to configure IIS's authentication, which then flows down to ASP.NET

How you do this depends on your version of IIS, in IIS7 expand out the tree and click your web site, then click Authentication and enable Windows Authentication