Windows Auth + Anononymous + Custom Application in SP Web App in IIS = SPContext.Current.Web.CurrentUser - null for authenticated users

Question

The Issue

There is a forum application (YetAnotherForum) that is integrated with SharePoint and allows posting (and other things) for authenticated users in SharePoint.

1. It has a customized membership provider that checks that SPContext.Current.Web.User and adds it to internal SQL storage and gives default permissions.
2. Forum application is configured as an Application in specific sharepoint IIS site (membership, role and profile providers).
3. SharePoint site and application use the same application pool

It works well when only Windows auth is enabled in Forum Application - users always identified correctly.

If anonymous auth is also enabled (together with Windows), it works fine for several minutes, then the SPContext.Current.Web.User is null. And forum considers user to be anonymous.

It works the same for all browsers, but FF and Chrome can recreate auth after one page view for anonymous. For example, user browse ok, then see access denied then browse ok a number of minutes.

For ie 9 - works fine, for ie 8 can restore auth for several requests and drop it again.

Current research status:

1. For ie - disable Integrated Windows Authentication - works well in ie, but requires end users to do this on their machines and not solve issues with other browser, just major part
2. http://geekswithblogs.net/mskoolaid/archive/2005/12/04/62164.aspx - this article seems to have a solution but is not available now

Known solutions (hacks)

I can create a httphandler or a web service, that will be placed on a normal site (_layouts), that will give me a correct user name or empty (if anonymous) using SPContext.Current.Web.CurrentUser, cause it works well on main site. Thus seems that the issue is in membership provider (change from SP to custom). But it'll give an additional call in each request and is very hackable.

If you know anything that can help in resolving the issue - please let me know.

Answer 1

The finally working hack was to create additional authentication page, as Authenticate.aspx in _layouts folder under main site, which has 2 option - authorize user and make a postback to source page with post params - user login and email.

Thus, when user opens a forum for the first time, forum checks a session variable and tries to get user login using redirect to authorization page. Then authorization page checks whether the user is logged in and sends the result back to requester page using redirect with post data. Forum checks for the user data and store it in session variable. If anonymous user wants to authenticate - he presses a link that redirects to authorization page with additional param, that makes SP authorization and returns back authorized user detail, that are saved again in session variable.