Hey Ryan,

It's possible but can be a little fiddly. In order to get your Umbraco solution using mixed mode authentication, I would recommend reading this blog post which describes how to do so.

In summary, you should enable forms authentication and disable windows authentication for the whole site. You'll then need to create a WinLogin.aspx page in the root of your site which has windows authentication enabled using the location configuration element in web.config. For example, while using the blog post above, you would have configuration like the following:

<location path="WinLogin.aspx">
    <formsAuthenticationWrapper enabled="false" />
    <system.webServer>
        <security>
            <authentication>
                <windowsAuthentication enabled="true">
                    <providers>
                        <clear />
                        <add value="NTLM" />
                        <add value="Negotiate" />
                    </providers>
                </windowsAuthentication>
                <anonymousAuthentication enabled="false" />
            </authentication>
        </security>
    </system.webServer>
</location>

This will allow your WinLogin.aspx page to handle windows authentication.

In order to detect a windows login for local users, your login page will need to detect which type of authentication to use. If forms authentication should be used, it should display the login page. If windows authentication should be used, your login page should redirect to WinLogin.aspx so that windows authentication can be used.

How do you detect this you might ask? Well, the only way I've found is to test a local url client side on your login page. If the client's browser can see the url, we know the user should be able to login via windows authentication and should be redirected to your WinLogin.aspx page. If the client's browser cannot see the url, we know the user should use forms authentication to login so we redirect the user back to the login page but with a query string parameter to stop any loop. For example, /login/?cmd=forms. On our login page, we display the actual login form if the query parameter is present.

I hope that helps in your quest for mixed mode authentication.

Thanks, Dan.