I have a new SP 2010 web-application configured for Claims authentication, with both 'windows' and 'forms' authentication.
Initially, I created a root site collection, set a windows site-collection-administrator and logged in with windows authentication without problem.
Note: I did not 'extend' into another zone, I applied changes to the original web-app.
Then, I followed the process of updating all 3 web-configs (web-app, central-admin, token-service) , create the fba database and added fba admin-users. I have configured the secondary site collection administrator as a fba user.
When I go to the login page, I get the 'choose forms/windows' authentication. The FBA user logs in successfully, and as a site-collection-admin, can mange the site, add users etc.
When I choose Windows auth though, it does authenticate but redirects to the initial login-choice page with additional URL parameters including 'access denied'
When I update the providers and remove forms auth, then Windows does work properly